Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:file.exe
Analysis ID:1313517
MD5:2ba491f6b487017a1c58b647a7e05d3c
SHA1:b5b7f44bf018de87168323cceb09a0934ea661e0
SHA256:e46720cac2a8956c652db483c7dd7b7fe0bcf7cdf8653d9687159e6355a17d7b
Tags:exe
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Fabookie, Glupteba, RedLine, SmokeLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected RedLine Stealer
Detected unpacking (overwrites its own PE header)
Found ransom note / readme
Yara detected Babuk Ransomware
Yara detected SmokeLoader
Yara detected Glupteba
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Antivirus detection for dropped file
Sigma detected: Drops script at startup location
Yara detected Clipboard Hijacker
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Yara detected Fabookie
Benign windows process drops PE files
Malicious sample detected (through community Yara rule)
Yara detected onlyLogger
Antivirus / Scanner detection for submitted sample
Yara detected Djvu Ransomware
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Maps a DLL or memory area into another process
Creates multiple autostart registry keys
Found Tor onion address
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Allocates memory in foreign processes
Modifies existing user documents (likely ransomware behavior)
Injects a PE file into a foreign processes
Contains functionality to inject code into remote processes
Writes many files with high entropy
Deletes itself after installation
Drops script or batch files to the startup folder
Writes a notice file (html or txt) to demand a ransom
Creates a thread in another existing process (thread injection)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Checks if the current machine is a virtual machine (disk enumeration)
Tries to harvest and steal browser information (history, passwords, etc)
PE file contains section with special chars
Writes to foreign memory regions
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Yara detected Generic Downloader
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a start menu entry (Start Menu\Programs\Startup)
Registers a DLL
PE file contains more sections than normal
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
PE file contains sections with non-standard names
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Extensive use of GetProcAddress (often used to hide API calls)
Uses cacls to modify the permissions of files
Connects to several IPs in different countries
Contains functionality to launch a program with higher privileges
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to query network adapater information

Classification

Process Tree

  • System is w10x64
  • svchost.exe (PID: 6248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • file.exe (PID: 6580 cmdline: C:\Users\user\Desktop\file.exe MD5: 2BA491F6B487017A1C58B647A7E05D3C)
    • explorer.exe (PID: 3524 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
      • 4A15.exe (PID: 4692 cmdline: C:\Users\user\AppData\Local\Temp\4A15.exe MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)
        • 4A15.exe (PID: 3164 cmdline: C:\Users\user\AppData\Local\Temp\4A15.exe MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)
          • icacls.exe (PID: 5452 cmdline: icacls "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: FF0D1D4317A44C951240FAE75075D501)
          • 4A15.exe (PID: 5976 cmdline: "C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)
            • 4A15.exe (PID: 6392 cmdline: "C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)
      • regsvr32.exe (PID: 3416 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\3958.dll MD5: D78B75FC68247E8A63ACBA846182740E)
        • regsvr32.exe (PID: 6780 cmdline: /s C:\Users\user\AppData\Local\Temp\3958.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
      • A388.exe (PID: 6820 cmdline: C:\Users\user\AppData\Local\Temp\A388.exe MD5: 3240F8928A130BB155571570C563200A)
        • conhost.exe (PID: 6852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • AddInProcess32.exe (PID: 4944 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: EFBCDD2A3EBEA841996AEF00417AA958)
        • AddInProcess32.exe (PID: 4948 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: EFBCDD2A3EBEA841996AEF00417AA958)
        • AddInProcess32.exe (PID: 4972 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: EFBCDD2A3EBEA841996AEF00417AA958)
          • i4PHS5R0iEKcuu4uBuaRKA3v.exe (PID: 6864 cmdline: "C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe" MD5: 2D05CB7FB4726BB51C6059540F0E013E)
          • Pwp3yspp3pM97CCYpnZxEaEs.exe (PID: 5488 cmdline: "C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333 MD5: 3E74B7359F603F61B92CF7DF47073D4A)
            • Pwp3yspp3pM97CCYpnZxEaEs.tmp (PID: 6028 cmdline: "C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp" /SL5="$1044C,4692544,832512,C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333 MD5: 5B1D2E9056C5F18324FA9DD4041B5463)
          • 4GAUQKCdkFpttJoyS2YGgxr9.exe (PID: 7012 cmdline: "C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe" MD5: 823B5FCDEF282C5318B670008B9E6922)
          • t3PINyJoW83t7JJSZ5BPE6bi.exe (PID: 7032 cmdline: "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe" MD5: 45B35CD3B6D3BF79D6880813EBCF1717)
            • t3PINyJoW83t7JJSZ5BPE6bi.exe (PID: 1360 cmdline: "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe" MD5: 45B35CD3B6D3BF79D6880813EBCF1717)
          • YRhJ9y7wcq2JenN54ladams2.exe (PID: 6296 cmdline: "C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe" MD5: A2CC32A235869FF08CE951A7C159D2A3)
            • YRhJ9y7wcq2JenN54ladams2.tmp (PID: 6660 cmdline: "C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp" /SL5="$30434,491750,408064,C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe" MD5: 83827C13D95750C766E5BD293469A7F8)
          • U58dhzMU8ddvYuIUxUkOSiON.exe (PID: 6200 cmdline: "C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe" MD5: E4FA45F80EC75D24124D434010023355)
          • 941caPIfMmGnCq8PWe7WWHEk.exe (PID: 7140 cmdline: "C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe" MD5: 64E22A1C0959444E0D23AE1977FB1075)
          • V1NdDWPeq5yoU55PUCrHuT1N.exe (PID: 1048 cmdline: "C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe" /s MD5: AA3602359BB93695DA27345D82A95C77)
          • f8hJzDp1zQtAPJgciyNSoGpb.exe (PID: 6776 cmdline: "C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe" MD5: 659F20996F8E561EDEF3227A4407A3C8)
  • svchost.exe (PID: 7016 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • jwjrtuw (PID: 6932 cmdline: C:\Users\user\AppData\Roaming\jwjrtuw MD5: 2BA491F6B487017A1C58B647A7E05D3C)
  • 4A15.exe (PID: 2456 cmdline: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)
    • 4A15.exe (PID: 2884 cmdline: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task MD5: 0511A0C819ADE47392A2F3A51EAF1F0B)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
BabukBabuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babuk
NameDescriptionAttributionBlogpost URLsLink
STOP, DjvuSTOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stop
NameDescriptionAttributionBlogpost URLsLink
FabookieFabookie is facebook account info stealer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.fabookie
NameDescriptionAttributionBlogpost URLsLink
GluptebaGlupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
NameDescriptionAttributionBlogpost URLsLink
SmokeLoaderThe SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://bulimu55t.net/", "http://soryytlic4.net/", "http://bukubuka1.net/", "http://novanosa5org.org/", "http://hujukui3.net/", "http://newzelannd66.org/", "http://golilopaster.org/"]}

Threatname: Djvu

{"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/raud/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-e5pgPH03fe\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0793", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArBrneEIQdBFXZaeBUAS8\\\\nwH7aMn3xZ2P0+v6VCnLGeU0C+9nPdY0vEKTGhmQmX5mTPxHx0YOio0MNfJigIngF\\\\nUurP7GwIzjiA9Vhh+E4oU4l3QncQbThKRZ3+N6k71ySVwL+15TJ00FBKk\\/z41dQu\\\\nQZqSgIS0T\\/7wW4CWCTLD3dewnt9CTD6UUN9A5dXBa3pxJf6gQeGgcF9MGkbaYsFn\\\\nucGyW1ppYe\\/4pPXENEo7OYgQDnJgch+X4BgMzRga6ix18adWGZj41gMHdRpFkjHE\\\\nsNZtuU5QQIgVkfWjmhv3PWTRQ5raftzMIvvycBmhiPeFwoDt8w3u1DFrAi65hWiD\\\\nWQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]JoeSecurity_RedLineYara detected RedLine StealerJoe Security
    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]MALWARE_Win_RedLineDetects RedLine infostealerditekSHen
    • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
    • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
    • 0x700:$s3: 83 EC 38 53 B0 7D 88 44 24 2B 88 44 24 2F B0 45 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
    • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
    • 0x1e9d0:$s5: delete[]
    • 0x1de88:$s6: constructor or from DllMain.
    C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeJoeSecurity_Clipboard_HijackerYara detected Clipboard HijackerJoe Security
      C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeWindows_Trojan_Clipbanker_f9f9e79dunknownunknown
      • 0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
      C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeWindows_Trojan_Clipbanker_787b130bunknownunknown
      • 0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
      • 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A
      • 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A
      • 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ...
      • 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
      Click to see the 6 entries

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000021.00000003.469268991.00000000056E7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
        00000021.00000003.468431350.0000000005643000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
          00000021.00000003.469512589.00000000057D7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
            0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_FabookieYara detected FabookieJoe Security
              00000021.00000003.470885243.0000000005859000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                Click to see the 163 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                  33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.raw.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
                  • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
                  • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
                  • 0x700:$s3: 83 EC 38 53 B0 7D 88 44 24 2B 88 44 24 2F B0 45 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
                  • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
                  • 0x1e9d0:$s5: delete[]
                  • 0x1de88:$s6: constructor or from DllMain.
                  25.2.4A15.exe.400000.0.unpackJoeSecurity_DjvuYara detected Djvu RansomwareJoe Security
                    25.2.4A15.exe.400000.0.unpackWindows_Ransomware_Stop_1e8d48ffunknownunknown
                    • 0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
                    • 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
                    25.2.4A15.exe.400000.0.unpackMALWARE_Win_STOPDetects STOP ransomwareditekSHen
                    • 0xfe888:$x1: C:\SystemID\PersonalID.txt
                    • 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC)
                    • 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\
                    • 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\
                    • 0xfecec:$s1: " --AutoStart
                    • 0xfed00:$s1: " --AutoStart
                    • 0x102948:$s2: --ForNetRes
                    • 0x102910:$s3: --Admin
                    • 0x102d90:$s4: %username%
                    • 0x102eb4:$s5: ?pid=
                    • 0x102ec0:$s6: &first=true
                    • 0x102ed8:$s6: &first=false
                    • 0xfedf4:$s7: delself.bat
                    • 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
                    • 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
                    • 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
                    Click to see the 61 entries

                    Sigma Signatures

                    Data Obfuscation

                    barindex
                    Sigma detected: Drops script at startup location
                    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, ProcessId: 4972, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QIttVglwj2HtPQeFbGsTsTBG.bat

                    Snort Signatures

                    ⊘No Snort rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Yara detected Glupteba
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.4b20e67.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.4af0e67.13.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.541185132.0000000004F63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.522431758.0000000000843000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 941caPIfMmGnCq8PWe7WWHEk.exe PID: 7140, type: MEMORYSTR
                    Antivirus detection for URL or domain
                    Source: http://app.nnnaajjjgc.com/URL Reputation: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/safeURL Reputation: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134664&key=5a5e7537a8885a65fb2b4176d4c48e2cAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9bec507f97304d55aAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d6Avira URL Cloud: Label: malware
                    Source: http://colisumy.com/dl/build2.exe$runAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372yAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55aad23e1Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55aAvira URL Cloud: Label: malware
                    Source: http://novanosa5org.org/Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/safebtAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135418&key=af1ae34227e74b84877a2b0bbf3bee9bmiAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d61:utAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134790&key=72224396aab18bba753981c520d8b1a5GhAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com:80/check/safeAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55a#Avira URL Cloud: Label: malware
                    Source: http://5.42.64.10/api/files/software/s5.exeAvira URL Cloud: Label: malware
                    Source: http://script.google.cpp.nnnaajjjgc.com/check/safeAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9b6C92Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d66C92Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c06C92Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c0Avira URL Cloud: Label: malware
                    Source: https://downloads.digitalpulsedata.com/0.16.16/DigitalPulse.exeAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54bAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/safe7OMAvira URL Cloud: Label: malware
                    Source: https://potatogoose.com/03ea740ea772f2ff2218e4ed0bfbac4b/baf14778c246e15550645e30ba78ce1c.exeAvira URL Cloud: Label: malware
                    Source: https://digitalpulsedata.com/pp/Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135324&key=7d66a132c21ba63fc78546c9d24589f2Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb98f379fab8Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b5Avira URL Cloud: Label: malware
                    Source: http://ji.alie3ksgbb.com/m/ss29Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134752&key=b91eaeee1ec96f7344a52c72e78649e0wAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdkOAvira URL Cloud: Label: malware
                    Source: http://soryytlic4.net/Avira URL Cloud: Label: malware
                    Source: http://zexeq.com/files/1/build3.exe$runAvira URL Cloud: Label: malware
                    Source: https://desktop-netinspp.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb9Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b30Avira URL Cloud: Label: malware
                    Source: http://zexeq.com/filespp.nnnaajjjgc.com/Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01GAvira URL Cloud: Label: malware
                    Source: https://potatogoose.comAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134630&key=a7f738ef34a58abfd14b211f7ae4d75a;Avira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/0vxAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1081221oAvira URL Cloud: Label: malware
                    Source: http://zexeq.com/files/1/build3.exerunAvira URL Cloud: Label: malware
                    Source: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01;Avira URL Cloud: Label: malware
                    Antivirus detection for dropped file
                    Source: C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exeAvira: detection malicious, Label: TR/Spy.Stealer.hpqrg
                    Source: C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exeAvira: detection malicious, Label: TR/AD.Swrort.wizll
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeAvira: detection malicious, Label: TR/Crypt.XPACK.Gen8
                    Source: C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exeAvira: detection malicious, Label: HEUR/AGEN.1338858
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exeAvira: detection malicious, Label: TR/Crypt.Agent.oqzji
                    Source: C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exeAvira: detection malicious, Label: TR/AD.Swrort.wizll
                    Source: C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exeAvira: detection malicious, Label: HEUR/AGEN.1312455
                    Source: C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exeAvira: detection malicious, Label: HEUR/AGEN.1312455
                    Source: C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exeAvira: detection malicious, Label: TR/AD.Swrort.wizll
                    Source: C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exeAvira: detection malicious, Label: HEUR/AGEN.1338858
                    Source: C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exeAvira: detection malicious, Label: HEUR/AGEN.1312455
                    Source: C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exeAvira: detection malicious, Label: HEUR/AGEN.1312455
                    Found malware configuration
                    Source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmpMalware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://bulimu55t.net/", "http://soryytlic4.net/", "http://bukubuka1.net/", "http://novanosa5org.org/", "http://hujukui3.net/", "http://newzelannd66.org/", "http://golilopaster.org/"]}
                    Source: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmpMalware Configuration Extractor: Djvu {"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/raud/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-e5pgPH03fe\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0793", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\"
                    Antivirus / Scanner detection for submitted sample
                    Source: file.exeAvira: detected
                    Multi AV Scanner detection for domain / URL
                    Source: http://colisumy.com/dl/build2.exe$runVirustotal: Detection: 17%Perma Link
                    Source: http://novanosa5org.org/Virustotal: Detection: 18%Perma Link
                    Source: http://app.nnnaajjjgc.com:80/check/safeVirustotal: Detection: 20%Perma Link
                    Source: http://5.42.64.10/api/files/software/s5.exeVirustotal: Detection: 13%Perma Link
                    Source: https://downloads.digitalpulsedata.com/0.16.16/DigitalPulse.exeVirustotal: Detection: 14%Perma Link
                    Source: https://digitalpulsedata.com/pp/Virustotal: Detection: 7%Perma Link
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exeReversingLabs: Detection: 70%
                    Source: C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exeReversingLabs: Detection: 22%
                    Source: C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exeReversingLabs: Detection: 70%
                    Source: C:\Users\user\AppData\Local\3e7TFXuOpvanKkAtgXUBsjg5.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exeReversingLabs: Detection: 95%
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeReversingLabs: Detection: 81%
                    Source: C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exeReversingLabs: Detection: 70%
                    Source: C:\Users\user\AppData\Local\90MmY3vsUc9ABzZegEZBdNOJ.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\AboFkE91gGtC0jX22BS3GOn1.exeReversingLabs: Detection: 34%
                    Source: C:\Users\user\AppData\Local\BYpvSgsqBQF2e9VWX5DwhO9b.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exeReversingLabs: Detection: 22%
                    Source: C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exeReversingLabs: Detection: 69%
                    Source: C:\Users\user\AppData\Local\HZmkan0RtnpmEbbLPyds7uQ6.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]ReversingLabs: Detection: 16%
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build2[1].exeReversingLabs: Detection: 95%
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exeReversingLabs: Detection: 81%
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s51[1]ReversingLabs: Detection: 16%
                    Source: C:\Users\user\AppData\Local\Mrqt0LPomy7YxUAwjV5w1C4Z.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\OdBy5UCgwCs2zOQ5hgwqYDDW.exeReversingLabs: Detection: 78%
                    Source: C:\Users\user\AppData\Local\PEETw0QK3zD9r7HEE5AR45AO.exeReversingLabs: Detection: 34%
                    Source: C:\Users\user\AppData\Local\QmwuUY15y0L4DcEZ4ogFMHTp.exeReversingLabs: Detection: 22%
                    Source: C:\Users\user\AppData\Local\SXfcayqkk1DZ7GAEIik6FBEC.exeReversingLabs: Detection: 22%
                    Source: C:\Users\user\AppData\Local\TNzDEBB9FdUrEB9ZmBfj0vTU.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\TUpbZ8vU8BuCVac1Gcxet4HJ.exeReversingLabs: Detection: 69%
                    Source: C:\Users\user\AppData\Local\Tc3J3MYPBvAb1zFAQ5lDv3bp.exeReversingLabs: Detection: 78%
                    Source: C:\Users\user\AppData\Local\Temp\2629.exeReversingLabs: Detection: 52%
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeReversingLabs: Detection: 55%
                    Source: C:\Users\user\AppData\Local\Temp\5838081746.exeReversingLabs: Detection: 16%
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeReversingLabs: Detection: 69%
                    Source: C:\Users\user\AppData\Local\Temp\BB52.exeReversingLabs: Detection: 77%
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpReversingLabs: Detection: 30%
                    Source: C:\Users\user\AppData\Local\TtG5py94KsXzXSkP3RqVlzUB.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\WQ1sXS4A8SPQ3OH5qUwmsfK7.exeReversingLabs: Detection: 78%
                    Source: C:\Users\user\AppData\Local\X4G1qMGsevrGDCsTxtK3q3TA.exeReversingLabs: Detection: 69%
                    Source: C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exeReversingLabs: Detection: 47%
                    Source: C:\Users\user\AppData\Local\c8KXUlVEBLWKm0FvrBR7FzOQ.exeReversingLabs: Detection: 70%
                    Source: C:\Users\user\AppData\Local\cIYKpG6eQ8E5shW60pciCDk9.exeReversingLabs: Detection: 34%
                    Machine Learning detection for sample
                    Source: file.exeJoe Sandbox ML: detected
                    Machine Learning detection for dropped file
                    Source: C:\Users\user\AppData\Local\G2DNcZFdbZ5vEmNAUVLs9Ohf.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]Joe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\CluIFFuzrOPmXrVReYWFXWkl.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\DFhwCIhHEDQ5pEOtcRuwyHkl.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\45jOwggrSgiiBeW99lMmxS6j.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00411178 CryptDestroyHash,CryptReleaseContext,11_2_00411178
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,11_2_0040E870
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040EA51 CryptDestroyHash,CryptReleaseContext,11_2_0040EA51
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,11_2_0040EAA0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040EC68 CryptDestroyHash,CryptReleaseContext,11_2_0040EC68
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,11_2_00410FC0

                    Bitcoin Miner

                    barindex
                    Yara detected Glupteba
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.4b20e67.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.4af0e67.13.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.541185132.0000000004F63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.522431758.0000000000843000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 941caPIfMmGnCq8PWe7WWHEk.exe PID: 7140, type: MEMORYSTR

                    Compliance

                    barindex
                    Detected unpacking (overwrites its own PE header)
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeUnpacked PE file: 11.2.4A15.exe.400000.0.unpack
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeUnpacked PE file: 25.2.4A15.exe.400000.0.unpack
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeUnpacked PE file: 29.2.4A15.exe.400000.0.unpack
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeUnpacked PE file: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeUnpacked PE file: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack
                    Detected unpacking (creates a PE file in dynamic memory)
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeUnpacked PE file: 26.2.i4PHS5R0iEKcuu4uBuaRKA3v.exe.3840000.2.unpack
                    Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1025\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1028\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1029\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1030\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1031\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1032\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1033\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1035\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1036\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1037\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1038\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1040\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1041\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1042\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1043\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1044\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1045\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1046\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1049\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1053\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1055\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2052\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2070\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\3082\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\_readme.txt
                    Source: C:\Users\user\Desktop\file.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpRegistry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{64F4736C-6169-4520-9368-BE1C9EAE552A}_is1
                    Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000002.00000000.376312472.00007FFC2B141000.00000020.00000001.01000000.00000005.sdmp
                    Source: Binary string: Loader.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\cr4shed\Desktop\MyHealthLoader\obj\Debug\MyHealthLoader.pdb source: 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.0000000003735000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: EfiGuardDxe.pdb7 source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmp
                    Source: Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Age does not matchThe module age and .pdb age do not match. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: symsrv.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000C79000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000005369000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: SetupUtility.pdb source: 4A15.exe, 00000019.00000003.473464201.0000000009A20000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: Downloading symbols for [%s] %ssrv*symsrv*http://https://_bad_pdb_file.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Setup.pdb source: 4A15.exe, 00000019.00000003.473294254.0000000009A20000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 4A15.exe, 4A15.exe, 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                    Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Magnify.pdb source: 4A15.exe, 00000019.00000003.526084395.0000000003170000.00000004.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000000.437080358.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.683131767.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp
                    Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000002.00000000.376312472.00007FFC2B141000.00000020.00000001.01000000.00000005.sdmp
                    Source: Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Drive not readyThis error indicates a .pdb file related failure. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Magnify.pdb@WH source: 4A15.exe, 00000019.00000003.526084395.0000000003170000.00000004.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000000.437080358.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.683131767.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp
                    Source: Binary string: mscorlib.pdb source: 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.0000000003735000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Unable to locate the .pdb file in this location source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: The module signature does not match with .pdb signature. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: .pdb.dbg source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: '(EfiGuardDxe.pdbx source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: symsrv.pdbGCTL source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000C79000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000005369000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: or you do not have access permission to the .pdb location. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: EfiGuardDxe.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 4A15.exe, 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                    Source: Binary string: eex.pdb source: explorer.exe, 00000002.00000000.376312472.00007FFC2B141000.00000020.00000001.01000000.00000005.sdmp
                    Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb0pH| source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmp
                    Source: Binary string: SetupUtility.pdb5 source: 4A15.exe, 00000019.00000003.473464201.0000000009A20000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: Signature does not matchThe module signature does not match with .pdb signature source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: dbghelp.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmp
                    Source: Binary string: dbghelp.pdbGCTL source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_00410160
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_0040F730
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,11_2_0040FB98

                    Networking

                    barindex
                    System process connects to network (likely due to code injection or exploit)
                    Source: C:\Windows\explorer.exeNetwork Connect: 104.21.18.99 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 79.137.192.18 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 213.6.54.58 443Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 189.232.123.108 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 195.201.202.58 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 162.159.133.233 443Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 193.42.32.101 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 144.76.136.153 443Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 194.169.175.127 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 77.91.68.78 80Jump to behavior
                    Yara detected onlyLogger
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.4260000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.4260000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: U58dhzMU8ddvYuIUxUkOSiON.exe PID: 6200, type: MEMORYSTR
                    Found Tor onion address
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntel
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmpString found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCDE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zaoshanghao.suhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionSoftware\Classes\ms-settings\shell\open\commandSoftware\Classes\ms-settings\shell\open\commandSoftware\Classes\ms-settings\shell\open\commandCommonProgramW6432=C:\Program Files\Common Files
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: -1729232121351c16372a14042518241f2dhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionS-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\TestAppS-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionS-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8FirstInstallDateS-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8S-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHzS-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8SELECT Name FROM Win32_VideoControllerS-1-5-21-3853321935-2125563209-4053062332-1002\Software\Microsoft\780aa3f8PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6SESSIONNAME=Consolewindir=C:\WindowsPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntel
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
                    Yara detected Generic Downloader
                    Source: Yara matchFile source: 14.2.A388.exe.21354a5ff10.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 18.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                    C2 URLs / IPs found in malware configuration
                    Source: Malware configuration extractorURLs: http://bulimu55t.net/
                    Source: Malware configuration extractorURLs: http://soryytlic4.net/
                    Source: Malware configuration extractorURLs: http://bukubuka1.net/
                    Source: Malware configuration extractorURLs: http://novanosa5org.org/
                    Source: Malware configuration extractorURLs: http://hujukui3.net/
                    Source: Malware configuration extractorURLs: http://newzelannd66.org/
                    Source: Malware configuration extractorURLs: http://golilopaster.org/
                    Source: Malware configuration extractorURLs: http://zexeq.com/raud/get.php
                    Source: unknownNetwork traffic detected: IP country count 11
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://171.22.28.208/dpp.nnnaajjjgc.com/
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://5.42.64.10
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://5.42.64.10/api/files/software/s5.exe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://85.217.144.143
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://85.217.144.143/files/My2.exe
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508069337.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510371610.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.624585849.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/0vx
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/Lv
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A19000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A22000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.453911428.00000000039E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134410&key=d8da1f375efe6f677fdf59da1e67cae1
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.478481171.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.468722131.00000000039E7000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.477596745.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.453911428.00000000039E7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134410&key=d8da1f375efe6f677fdf59da1e67cae1j
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.478481171.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.468722131.00000000039E7000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.477596745.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134520&key=b7ede437f78d86896c262b77e451a861
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.478481171.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.477596745.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134630&key=a7f738ef34a58abfd14b211f7ae4d75a;
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.478481171.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.477596745.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134664&key=5a5e7537a8885a65fb2b4176d4c48e2c
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.475552135.0000000003A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134664&key=5a5e7537a8885a65fb2b4176d4c48e2cco
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487859289.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487163158.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487415421.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372;
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372W
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504972513.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487859289.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504033756.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508038273.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487163158.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487415421.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372y
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487382669.0000000003A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134752&key=b91eaeee1ec96f7344a52c72e78649e0
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487382669.0000000003A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134752&key=b91eaeee1ec96f7344a52c72e78649e0w
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134790&key=72224396aab18bba753981c520d8b1a5
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134790&key=72224396aab18bba753981c520d8b1a5Gh
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504972513.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504033756.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493700002.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493700002.0000000003A08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01)Q
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc016C92co
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01;
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493700002.0000000003A08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01AP
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01G
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504972513.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504033756.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01_
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01b
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01hrome/116.0.0.0
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55a
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508038273.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55a#
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55aad23e1
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510394090.0000000003A08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9b
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9b6C92
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9bec507f97304d55a
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9bgc
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134958&key=41250e8bd6a56f64e8c0405a6d7193b4
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb9
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A25000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb98f379fab8
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb98f379fab8?
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A25000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb98f379fab8hrome/116.0.0.0
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135090&key=edd7cc6d7a3da0e6fcfef9be40b04de5
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.529764912.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.529294566.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135096&key=926573ae433d4e9b1289658ba0ba5ac36C92
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.550000806.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135144&key=023c731ba3587eb5248d1c34c3dff713
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.550000806.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b30
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b5
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.546344384.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.543043426.0000000003A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b6C92
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135324&key=7d66a132c21ba63fc78546c9d24589f2
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d6
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d61:ut
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d630
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d66C92
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.557010087.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d66C9221
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d6VpT2pFMk9UbjA9
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d6y
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135404&key=68acdef07771384dfd60618d4ee3762c
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.580765017.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.580765017.0000000003A2B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.572402015.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.568847528.0000000003A2C000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135418&key=af1ae34227e74b84877a2b0bbf3bee9b
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.572402015.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135418&key=af1ae34227e74b84877a2b0bbf3bee9b_
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.580765017.0000000003A2B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.568847528.0000000003A2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135418&key=af1ae34227e74b84877a2b0bbf3bee9bmi
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.589146137.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135610&key=4046e3a9fdb6e9ea3edf724aa957aa89
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.589146137.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135610&key=4046e3a9fdb6e9ea3edf724aa957aa8930
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.588792935.0000000003A2B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1081221o
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.624585849.0000000003A10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135936&key=9f52c9e763a3022767eed76259d3a4df
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.624585849.0000000003A10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135936&key=9f52c9e763a3022767eed76259d3a4dfDyn
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1135936&key=9f52c9e763a3022767eed76259d3a4dfHYd/S4Buu41P
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.641242547.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.639907595.00000000039C4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.640934427.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c0
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.641242547.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.639907595.00000000039C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c030
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.640934427.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c06C92
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.653204608.00000000039C7000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.646375492.00000000039C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136228&key=c0307c8142a402d39ed54c9eadddda2e30
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136228&key=c0307c8142a402d39ed54c9eadddda2eo
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bd
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.00000000039C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bd30
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bd?
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdI
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdJO0x
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdkO
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdl
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safe
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487382669.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.475552135.0000000003A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safe$l4x
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.646375492.00000000039C2000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.639907595.00000000039C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safe7OM
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493700002.0000000003A08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safe9P
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.572402015.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeGz2QMa%
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493700002.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeI
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeL
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.572402015.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeRNM1sQ
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.653204608.00000000039C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeae/pIp2nc7wI0OOZ7ODWvQOKWZEwtQr8kNPChgS4fnzXGoNlFvG/T2NimDhtjD7a
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safebt
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safed
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487382669.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.475552135.0000000003A24000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeglux
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safeo
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508069337.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.550000806.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541941519.00000000039CB000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510371610.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safep
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com/check/safet
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://app.nnnaajjjgc.com:80/check/safe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://colisumy.com/dl/build2.exe
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://colisumy.com/dl/build2.exe$run
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://colisumy.com/dl/build2.exerun
                    Source: explorer.exe, 00000002.00000000.376345728.00007FFC2B229000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov
                    Source: explorer.exe, 00000002.00000000.376345728.00007FFC2B229000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.g
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
                    Source: svchost.exe, 00000004.00000002.448095688.000001AC75CEC000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000003.433589617.000000000074E000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435946180.000000000074C000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.690591915.0000000001134000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.450265651.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.678164342.000000000078C000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000003.584736156.000000000078C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.450265651.0000000001521000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.m
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DA7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                    Source: svchost.exe, 00000004.00000002.448095688.000001AC75CEC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DA7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionPROCESSOR_IDENTIFIER=Intel64
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionS-1-5-21-3853321935-2125563209-
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttp://cvwwajk56uu2la7jl4e2fdxy
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.526186837.0000000002051000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://demo.seafile.com/f/4dd787a6a9b74434b278/?dl=1
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://down.360safe.com/setup.exePathSOFTWARE
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445817611.0000000000487000.00000008.00000001.01000000.00000018.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445817611.0000000000487000.00000008.00000001.01000000.00000018.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445817611.0000000000487000.00000008.00000001.01000000.00000018.sdmpString found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeBUTTONBUTTONProduct32Product64
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://galandskiyher3.com/downloads/toolspub1.exe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://hbn42414.beget.tech
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://hbn42414.beget.tech/385118/setup.exe
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.572402015.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://host-host-file8pp.nnnaajjjgc.com/check/safe
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://https://_bad_pdb_file.pdb
                    Source: 4A15.exe, 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://int.down.360safe.com
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://int.down.360safe.com/totalsecurity/360TS_Setup_Mini_WW_InstallRox_CPI202211_6.6.0.1054.exe
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://invalidlog.txtlookup
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000000.444126937.000000000056E000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000000.444126937.000000000056E000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabXhttp://www.360totalsecurity.c
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000000.444126937.000000000056E000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab9http://int.down.360safe.com/
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ji.alie3ksgbb.com/m/ss29
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.526186837.0000000002051000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://link.storjshare.io/jw6d5ycuf7e6mtiudwapyqs22o2q/less-bucket%2F3la%20barra%2FLightCleaner.exe?
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DA7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0-
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://pinst.360.cn/360se/wssj_setup.cabGdiplus.dllGdiplusStartupGdiplusShutdownGdipCreateFromHDCGdi
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://pinst.360.cn/zhuomian/desktopsafe.cabSoftware
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://s.360safe.com/360ts/mini_inst.htm?ver=%s&pid=%s&os=%s&mid=%s&state=%d&opr_state=%xhttp://s.36
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.360safe.com/pp.nnnaajjjgc.com/check/?sid=1136228&key=c0307c8142a402d39ed54c9eadddda2e
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.00000000035F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.640934427.0000000003A3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://script.google.cpp.nnnaajjjgc.com/check/safe
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000000.444126937.000000000056E000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://www.360safe.com/totalsecurity/en/101/tswin10u/d7http://www.360safe.com/totalsecurity/en/101/t
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WAR
                    Source: 4A15.exe, 00000019.00000003.516080817.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                    Source: 4A15.exe, 00000019.00000003.516184671.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.442316567.0000000002440000.00000004.00001000.00020000.00000000.sdmp, YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.443753613.0000000002330000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.innosetup.com/
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000002.526416925.0000000000401000.00000020.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000002.526416925.0000000000401000.00000020.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                    Source: 4A15.exe, 00000019.00000003.516223554.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.live.com/
                    Source: 4A15.exe, 00000019.00000003.516248171.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.nytimes.com/
                    Source: 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002E44000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.opera.com0
                    Source: 4A15.exe, 00000019.00000003.516279370.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.reddit.com/
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.442316567.0000000002440000.00000004.00001000.00020000.00000000.sdmp, YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.443753613.0000000002330000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.remobjects.com/ps
                    Source: YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.442316567.0000000002440000.00000004.00001000.00020000.00000000.sdmp, YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.443753613.0000000002330000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.remobjects.com/psU
                    Source: 4A15.exe, 00000019.00000003.516314996.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/
                    Source: 4A15.exe, 00000019.00000003.516366313.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.wikipedia.com/
                    Source: 4A15.exe, 00000019.00000003.516430209.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/
                    Source: 4A15.exe, 00000019.00000003.527546819.000000000065D000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.529745378.00000000030B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exe
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exe$run
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exe$run8
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exe$runC
                    Source: 4A15.exe, 00000019.00000002.528888660.000000000065D000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.527546819.000000000065D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exe-N
                    Source: 4A15.exe, 00000019.00000003.526920988.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528078249.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.529745378.00000000030B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exerun
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/files/1/build3.exerunXp.
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/filespp.nnnaajjjgc.com/
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/raud/get.php
                    Source: 4A15.exe, 00000019.00000002.528888660.000000000061C000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528105248.000000000061B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/raud/get.php?pid=F4B58C92E14ED1DB6A495C4F0112806C&first=trueB
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zexeq.com/raud/get.php?pid=F4B58C92E14ED1DB6A495C4F0112806C&first=trueW
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A3E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.678164342.000000000078C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/
                    Source: 4A15.exe, 0000000B.00000002.435946180.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000003.433599791.000000000071D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/M
                    Source: 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.678164342.000000000078C000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json
                    Source: 4A15.exe, 00000019.00000002.528784929.00000000005C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json&A
                    Source: 4A15.exe, 0000001D.00000002.678164342.000000000078C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json7
                    Source: 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonB
                    Source: 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsoni
                    Source: 4A15.exe, 00000019.00000002.528784929.0000000000578000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonp
                    Source: 4A15.exe, 0000001D.00000003.584736156.000000000076E000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonr
                    Source: 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonz
                    Source: U58dhzMU8ddvYuIUxUkOSiON.exe, 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
                    Source: U58dhzMU8ddvYuIUxUkOSiON.exe, 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/iphttps://api.my-ip.io
                    Source: U58dhzMU8ddvYuIUxUkOSiON.exe, 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.my-ip.io
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: https://blockchain.infoindex
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d241.userscloud.net/d/hulq6euctn2fvxijrtnj7gioldutikskeaas5n4z5jprs4ng4yrlvcutm4k33tidjh4auv
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinspp.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bd
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dev.vk.com
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000002.677592753.0000000002301000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://digitalpulsedata.com/
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.439723896.00000000024F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://digitalpulsedata.com/:https://digitalpulsedata.com/:https://digitalpulsedata.com/
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.439723896.00000000024F0000.00000004.00001000.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000002.677592753.0000000002287000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://digitalpulsedata.com/pp/
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.439723896.00000000024F0000.00000004.00001000.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000002.677592753.0000000002287000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://digitalpulsedata.com/tos/.
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000002.677592753.0000000002271000.00000004.00001000.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.439723896.00000000024F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://digitalpulsedata.com/uninstall/?guid=
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://downloads.digitalpulsedata.com/0.16.16/DigitalPulse.exe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://flyawayaero.net/baf14778c246e15550645e30ba78ce1c.exe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://iplogger.com/1uNwK4
                    Source: explorer.exe, 00000002.00000000.374746176.00000000068D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.374517074.0000000004AFA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://java.sun.com
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://jetpackdelivery.net/7a54bdb20779c4359694feaa1398dd25.exe
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000000.439502509.0000000000401000.00000020.00000001.01000000.00000011.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://justsafepay.com/03ea740ea772f2ff2218e4ed0bfbac4b/7a54bdb20779c4359694feaa1398dd25.exe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://link.storjshare.io/jwwi6qvijjcy2bytemq4e4pelcoa/installer%2FLightCleaner.exe?download=1
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.vk.com/
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.vk.com/?act=login
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.vk.com/?act=logout&hash=7472f290654d0fb45c&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lycheepanel.info/download/?cid=client7
                    Source: 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.00000000035F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://m7val1dat0r.info
                    Source: 4A15.exe, 00000019.00000003.519668767.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.00000000035F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://m7val1dat0r.info/loader
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
                    Source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpString found in binary or memory: https://orion.ts.360.com/promo/opera?ch=%s&sch=%s&ver=%s&lan=%s&os=%s&mid=%s&mver=%s&time=%I64d/down
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://papi.vk.com/pushsse/ruim
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/xYhKBupz
                    Source: A388.exe, 0000000E.00000002.428047892.0000021354A50000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.661613256.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/xYhKBupz1https://yip.su/RNWPd.exe7https://iplogger.com/1uNwK4
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.comG
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://potatogoose.com
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D97000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://potatogoose.com/03ea740ea772f2ff2218e4ed0bfbac4b/baf14778c246e15550645e30ba78ce1c.exe
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.589146137.00000000039CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pp.nnnaajjjgc.com/
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.624585849.0000000003A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://script.google.pp.nnnaajjjgc.com/check/?sid=1135936&key=9f52c9e763a3022767eed76259d3a4df
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DA7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://st6-20.vk.com
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://st6-20.vk.com/css/al/base.2e3fc345b3e9701dafc5.css
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://st6-20.vk.com/css/al/common.46325ec9e7cba25feea7.css
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://st6-20.vk.com/css/al/fonts_cnt.c7a76efe4d312a46c1b8.css
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://st6-20.vk.com/css/al/fonts_utf.7fa94adac24497ce4d3a.css
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://st6-20.vk.com/css/al/vkui.f5be3fae592194cc6a35.css
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stats.vk-portal.net
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.582090716.00000000039DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://telegram.org/pp.nnnaajjjgc.com/
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpString found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vk.com
                    Source: 4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://vk.com/away.php?to=https%3A%2F%2F1l-go.mail.ru%2Fr%2Fadid%2F3245029_2013344%2Fpid%2F102819%2
                    Source: 4A15.exe, 00000019.00000002.528888660.0000000000629000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528105248.0000000000629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://we.tl/t-e5pgPH03
                    Source: 4A15.exe, 00000019.00000002.528888660.0000000000629000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528105248.0000000000629000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://we.tl/t-e5pgPH03c
                    Source: 4A15.exe, 00000019.00000003.527825412.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528097167.00000000030A0000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.529745378.00000000030A1000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528888660.000000000061C000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.472838166.00000000030D9000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528105248.000000000061B000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526920988.00000000030A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://we.tl/t-e5pgPH03fe
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amsangroup.com
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amsangroup.com/wp-includes/net/gate4.exe
                    Source: 4A15.exe, 00000019.00000003.519668767.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.health.com/
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000024F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.innosetup.com/
                    Source: Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000024F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.remobjects.com/ps
                    Source: AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://yip.su/RNWPd.exe
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.000000000143B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://z.nnnaajjjgc.com/
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.000000000143B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://z.nnnaajjjgc.com/4)
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.684798567.00007FF77A421000.00000040.00000001.01000000.0000000F.sdmpString found in binary or memory: https://z.nnnaajjjgc.com/sts/imagd.jpg
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCC8000.00000004.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DC88000.00000004.00001000.00020000.00000000.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.553319805.000000000DC14000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zaoshanghao.su
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCDA000.00000004.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCC8000.00000004.00001000.00020000.00000000.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.553319805.000000000DC14000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zaoshanghao.suMicrosoft
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCDE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zaoshanghao.suhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionSoftware
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DC88000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://zaoshanghao.suhttps://zaoshanghao.suRegQueryValueExWUUIDPGDSE
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,11_2_0040CF10
                    Source: svchost.exe, 00000004.00000003.424846400.000001AC765CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.424827668.000001AC765AB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.424772638.000001AC765B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\n*Calls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy | LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-11T23:48:25.5854013Z||.||a7da40df-b5be-40f6-b49d-5ac70d4d5568||1152921505696762320||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2023-09-11T23:48:04.9851982Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free* texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: InitOnceExecuteOnceCreateSemaphoreWCreateSemaphoreExWCreateThreadpoolTimerSetThreadpoolTimerWaitForThreadpoolTimerCallbacksCloseThreadpoolTimerCreateThreadpoolWaitSetThreadpoolWaitCloseThreadpoolWaitFlushProcessWriteBuffersFreeLibraryWhenCallbackReturnsGetCurrentProcessorNumberCreateSymbolicLinkWGetCurrentPackageIdSetFileInformationByHandleInitializeConditionVariableWakeConditionVariableInitializeSRWLockAcquireSRWLockExclusiveTryAcquireSRWLockExclusiveReleaseSRWLockExclusiveSleepConditionVariableSRWCreateThreadpoolWorkSubmitThreadpoolWorkCloseThreadpoolWorkUnknown exceptionbad array new lengthstring too longmap/set too longMUI1isinstall0macuidun_pwdc_userdblnMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36https://www.facebook.com/ed/login/ice-bas/login/dev"="st"azoe"jsd""luid"=urce""sot=oesjazlsd&d=&uirce=&souxt=&nehttps://www.facebook.com/login/device-based/login/ersc_uonkieJscoocookieJsonhttps://adsmanager.facebook.com/ads/manager/accounts<tbodyaccountIdpayInfo</tbody>></tr><tr?act</td> <tdlastRowdata-sortpaidbilling_statushttps://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id"ACCOUNT_ID":"globalScopeID":token":""DTSGInitData""LSD",:"__spin_r""__spin_t"av=&__user=&__a=1&__csr=&__req=5&dpr=1&__ccg=EXCELLENT&__comet_req=0&fb_dtsg=&lsd=&__spin_r=&__spin_b=trunk&__spin_t=&fb_api_caller_class=RelayModern&fb_api_req_friendly_name=BillingAMNexusRootQuery&variables={"paymentAccountID":""}&server_timestamps=true&doc_id=4123775161071594https://business.facebook.com/api/graphql/?lll=pppdatabillable_account_by_payment_accountbilling_payment_accountbilling_payment_methodspayment_modesSUPPORTS_POSTPAYhttps://business.facebook.com/selectbusiness_id=businesshttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks}"profile_switcher_eligible_profiles":{"count"hasHomePage"admined_pages":{"nodes":[{"id"aria-label="Verified"http://app.nnnaajjjgc.com/check/safe{"sid":0,"time":0,"rand_str":""}http://app.nnnaajjjgc.com/check/?sid=sid#IO$J2&89DFJ2^984%7FJfj<>asi?h3.728*fhastimerand_str89%3gj,IH@<F7>84|j5kl3;4y:jdFJOhf01(92)3&key=invalid vector subscriptinvalid string positionvector too long equals www.facebook.com (Facebook)
                    Source: 4A15.exe, 00000019.00000003.516141592.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
                    Source: 4A15.exe, 00000019.00000003.516314996.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
                    Source: 4A15.exe, 00000019.00000003.516430209.0000000003170000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
                    Source: svchost.exe, 00000004.00000002.448011878.000001AC75CC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"Sear equals www.facebook.com (Facebook)
                    Source: svchost.exe, 00000004.00000002.448011878.000001AC75CC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"Sear equals www.twitter.com (Twitter)
                    Source: svchost.exe, 00000004.00000002.448011878.000001AC75CC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"Sear(x equals www.facebook.com (Facebook)
                    Source: svchost.exe, 00000004.00000002.448011878.000001AC75CC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"Sear(x equals www.twitter.com (Twitter)
                    Source: svchost.exe, 00000004.00000003.436311110.000001AC765AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.436303029.000001AC765A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-22T12:09:58.6371163Z||.||ac40657f-579b-4a38-b3ff-1e6a8cd648f9||1152921505696806515||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":["HeadlessApp"],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"202
                    Source: svchost.exe, 00000004.00000003.436311110.000001AC765AF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.436303029.000001AC765A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \nLike us on Facebook: http://www.facebook.com/spotify\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-22T12:09:58.6371163Z||.||ac40657f-579b-4a38-b3ff-1e6a8cd648f9||1152921505696806515||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":["HeadlessApp"],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"202
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: iostreambad castbad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setinvalid stoi argumentstoi argument out of range^(([^:\/?#]+):)?(//([^\/?#:]*)(:([^\/?#]*))?)?([^?#]*)(\?([^#]*))?(#(.*))?httphttps?POSTGET/device-based/loginContent-Type: application/x-www-form-urlencodedContent-Length: facebooksec-ch-ua: "Not.A/Brand";v="8", "Chromium";v="114", "Microsoft Edge";v="114"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1Connection: keep-alive/selectHost: business.facebook.comsec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1Sec-Fetch-Mode: navigate: ?1Sec-Fetch-Userest: documentSec-Fetch-Dame-originch-Site: sSec-Fet/accountsHost: adsmanager.facebook.com/billing_hub/bile: ?0a-mosec-ch-urm: "Windows"latfosec-ch-ua-polor-scheme: lightefers-csec-ch-precure-Requests: 1de-InsUpgraetch-Site: noneSec-Fode: navigateetch-Mer: ?1c-Fetch-UsSementest: docutch-DSec-Feapi/graphql/?lll=pppX-FB-Friendly-Name: BillingHubPaymentSettingsPaymentMethodsListQueryOrigin: https://business.facebook.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: empty/v15.0/k.comcebooHost: graph.fadows": "Winsec-ch-ua-platform-urlencodedpplication/x-www-formContent-type: aept: */*Accok.comaceboOrigin: https://www.fame-sitetch-Site: stch-Mode: corsmptych-Dest: eook.com///www.facebReferer: https:ook.comw.facebHost: wwobile: ?0-ch-ua-msecindows"a-platform: "Ws-color-scheme: lightprefersec-ch-equests: 1ecure-RUpgrade-InsSec-Fetch-Site: noneMode: navigateSec-Fetch-ser: ?1Sec-Fetch-Uentst: documSec-Fetch-DeCache-Control: max-age=0vector<bool> too longalnumalnumalphaalphablankblankcntrlcntrldddigitdigitgraphgraphlowerlowerprintprintpunctpunctspacespacesupperupperwwxdigitxdigit equals www.facebook.com (Facebook)
                    Source: svchost.exe, 00000004.00000003.424833774.000001AC7656C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\n*Calls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy | LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-11T23:48:25.5854013Z||.||a7da40df-b5be-40f6-b49d-5ac70d4d5568||1152921505696762320||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2023-09-11T23:48:04.9851982Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free* texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE
                    Source: svchost.exe, 00000004.00000003.424833774.000001AC7656C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.424817479.000001AC7659A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: t enough.\r\n\r\nSHARE WITH FRIENDS\r\nSend photos and videos to keep your close friends up to speed. Receive files for even more productivity.\r\n\r\n\r\n*Calls are free over Wi-Fi but otherwise standard data charges apply.\r\nPrivacy Policy: https://www.facebook.com/about/privacy | LEARN MORE at: https://messenger.com (https://messenger.com/)","ProductTitle":"Messenger","SearchTitles":[],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9WZDNCRF0083","Properties":{"PackageFamilyName":"Facebook.317180B0BB486_8xx8rvfyw5nnt","PackageIdentityName":"FACEBOOK.317180B0BB486","PublisherCertificateName":"CN=6E08453F-9BA7-4311-999C-D22FBA2FB1B8","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"c6a9fa5c-20a2-4e12-904d-edd408657dc8"},{"IdType":"LegacyWindowsPhoneProductId","Value":"3219d30d-4a23-4f58-a91c-c44b04e6a0c7"},{"IdType":"XboxTitleId","Value":"2004208728"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2023-09-11T23:48:25.5854013Z||.||a7da40df-b5be-40f6-b49d-5ac70d4d5568||1152921505696762320||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku":{"LastModifiedDate":"2023-09-11T23:48:04.9851982Z","LocalizedProperties":[{"SkuDescription":"Made for big screens and close connections. Get access to free* texting, and high-quality voice & video chat built specifically for desktop.\r\n\r\nMADE FOR DESKTOP, MADE

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Yara detected SmokeLoader
                    Source: Yara matchFile source: 37.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 31.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.27d15a0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,11_2_004822E0
                    Source: file.exe, 00000001.00000002.376731132.0000000002648000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>memstr_e12d178d-f

                    E-Banking Fraud

                    barindex
                    Yara detected Glupteba
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.4b20e67.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.4af0e67.13.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.541185132.0000000004F63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.522431758.0000000000843000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 941caPIfMmGnCq8PWe7WWHEk.exe PID: 7140, type: MEMORYSTR

                    Spam, unwanted Advertisements and Ransom Demands

                    barindex
                    Found ransom note / readme
                    Source: C:\_readme.txtDropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-e5pgPH03fePrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshmail.topReserve e-mail address to contact us:datarestorehelp@airmail.ccYour personal ID:0793lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmTJump to dropped file
                    Yara detected Babuk Ransomware
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 6392, type: MEMORYSTR
                    Yara detected Djvu Ransomware
                    Source: Yara matchFile source: 25.2.4A15.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 25.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 24.2.4A15.exe.43815a0.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 24.2.4A15.exe.43815a0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.4A15.exe.44715a0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.4A15.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 27.2.4A15.exe.43915a0.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 11.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 29.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 27.2.4A15.exe.43915a0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.4A15.exe.44715a0.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 29.2.4A15.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 4692, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 3164, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 5976, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 6392, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 2456, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: 4A15.exe PID: 2884, type: MEMORYSTR
                    Modifies existing user documents (likely ransomware behavior)
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile moved: C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile moved: C:\Users\user\Desktop\MXPXCVPDVN\NEBFQQYWPS.jpg
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile moved: C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile moved: C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.pdf
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile moved: C:\Users\user\Desktop\ZQIXMVQGAH.xlsx
                    Writes many files with high entropy
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\yRbowIjZdxellWMLi8kEb6gJ.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\GlKtZqXQAiyhJM8NCtTVvYcF.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\46ajs7POqByEYUKIKWz4ttVU.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\3zaREjkJ8eT5V6QYRyuztw7a.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exe entropy: 7.99984962795Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\zDIXJhMuVzNtJxExlDXABWMh.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\ghXDF7wc1k0lMAVWTQE9mN9d.exe entropy: 7.99591438001Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1049\eula.rtf entropy: 7.99076919624Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1049\LocalizedData.xml entropy: 7.99754285623Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1053\LocalizedData.xml entropy: 7.99786232361Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1055\LocalizedData.xml entropy: 7.99782642787Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2052\LocalizedData.xml entropy: 7.9973313107Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2070\LocalizedData.xml entropy: 7.99781623342Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\3082\LocalizedData.xml entropy: 7.99791484053Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Print.ico entropy: 7.99851955206Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate1.ico entropy: 7.99894080626Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate10.ico entropy: 7.9985073103Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate2.ico entropy: 7.99869741568Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate3.ico entropy: 7.9987694436Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate4.ico entropy: 7.99867667446Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate5.ico entropy: 7.99868049861Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate6.ico entropy: 7.99863013359Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate7.ico entropy: 7.99883156893Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate8.ico entropy: 7.99878346558Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate9.ico entropy: 7.99874641609Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Save.ico entropy: 7.99842005011Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Setup.ico entropy: 7.99863774825Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqMet.ico entropy: 7.99888594552Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqNotMet.ico entropy: 7.99859493498Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\DisplayIcon.ico entropy: 7.99762161073Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Setup.exe entropy: 7.99839623586Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\SetupUi.xsd entropy: 7.99398242604Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\SplashScreen.bmp entropy: 7.99847173258Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\UiInfo.xml entropy: 7.99673571701Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\watermark.bmp entropy: 7.99811635994Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1025\LocalizedData.xml entropy: 7.99764925768Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1028\LocalizedData.xml entropy: 7.99723183467Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1029\LocalizedData.xml entropy: 7.99813486448Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1030\LocalizedData.xml entropy: 7.9973820247Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1031\LocalizedData.xml entropy: 7.99796232163Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1032\LocalizedData.xml entropy: 7.99785301137Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1033\LocalizedData.xml entropy: 7.99773003168Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1035\LocalizedData.xml entropy: 7.99754727376Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1036\LocalizedData.xml entropy: 7.99794968928Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1037\LocalizedData.xml entropy: 7.9980651264Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1038\LocalizedData.xml entropy: 7.99798098502Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1040\LocalizedData.xml entropy: 7.99805711069Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1041\eula.rtf entropy: 7.99217307553Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1041\LocalizedData.xml entropy: 7.99790523034Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1042\eula.rtf entropy: 7.99007850689Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1042\LocalizedData.xml entropy: 7.99723894124Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1043\LocalizedData.xml entropy: 7.99791986218Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1044\LocalizedData.xml entropy: 7.99734842538Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1045\LocalizedData.xml entropy: 7.99800749719Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1046\LocalizedData.xml entropy: 7.99775905389Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\DisplayIcon.ico.azhi (copy) entropy: 7.99762161073Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Setup.exe.azhi (copy) entropy: 7.99839623586Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\SetupUi.xsd.azhi (copy) entropy: 7.99398242604Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\SplashScreen.bmp.azhi (copy) entropy: 7.99847173258Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\UiInfo.xml.azhi (copy) entropy: 7.99673571701Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\watermark.bmp.azhi (copy) entropy: 7.99811635994Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1025\LocalizedData.xml.azhi (copy) entropy: 7.99764925768Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1028\LocalizedData.xml.azhi (copy) entropy: 7.99723183467Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1029\LocalizedData.xml.azhi (copy) entropy: 7.99813486448Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1030\LocalizedData.xml.azhi (copy) entropy: 7.9973820247Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1031\LocalizedData.xml.azhi (copy) entropy: 7.99796232163Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1032\LocalizedData.xml.azhi (copy) entropy: 7.99785301137Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1033\LocalizedData.xml.azhi (copy) entropy: 7.99773003168Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1035\LocalizedData.xml.azhi (copy) entropy: 7.99754727376Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1036\LocalizedData.xml.azhi (copy) entropy: 7.99794968928Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1037\LocalizedData.xml.azhi (copy) entropy: 7.9980651264Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1038\LocalizedData.xml.azhi (copy) entropy: 7.99798098502Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1040\LocalizedData.xml.azhi (copy) entropy: 7.99805711069Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1041\eula.rtf.azhi (copy) entropy: 7.99217307553Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1041\LocalizedData.xml.azhi (copy) entropy: 7.99790523034Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1042\eula.rtf.azhi (copy) entropy: 7.99007850689Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1042\LocalizedData.xml.azhi (copy) entropy: 7.99723894124Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1043\LocalizedData.xml.azhi (copy) entropy: 7.99791986218Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1044\LocalizedData.xml.azhi (copy) entropy: 7.99734842538Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1045\LocalizedData.xml.azhi (copy) entropy: 7.99800749719Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1046\LocalizedData.xml.azhi (copy) entropy: 7.99775905389Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1049\eula.rtf.azhi (copy) entropy: 7.99076919624Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1049\LocalizedData.xml.azhi (copy) entropy: 7.99754285623Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1053\LocalizedData.xml.azhi (copy) entropy: 7.99786232361Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1055\LocalizedData.xml.azhi (copy) entropy: 7.99782642787Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2052\LocalizedData.xml.azhi (copy) entropy: 7.9973313107Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2070\LocalizedData.xml.azhi (copy) entropy: 7.99781623342Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\3082\LocalizedData.xml.azhi (copy) entropy: 7.99791484053Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Print.ico.azhi (copy) entropy: 7.99851955206Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate1.ico.azhi (copy) entropy: 7.99894080626Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate10.ico.azhi (copy) entropy: 7.9985073103Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate2.ico.azhi (copy) entropy: 7.99869741568Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate3.ico.azhi (copy) entropy: 7.9987694436Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate4.ico.azhi (copy) entropy: 7.99867667446Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate5.ico.azhi (copy) entropy: 7.99868049861Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate6.ico.azhi (copy) entropy: 7.99863013359Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate7.ico.azhi (copy) entropy: 7.99883156893Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate8.ico.azhi (copy) entropy: 7.99878346558Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate9.ico.azhi (copy) entropy: 7.99874641609Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Save.ico.azhi (copy) entropy: 7.99842005011Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Setup.ico.azhi (copy) entropy: 7.99863774825Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqMet.ico.azhi (copy) entropy: 7.99888594552Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqNotMet.ico.azhi (copy) entropy: 7.99859493498Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exe.azhi (copy) entropy: 7.99984962795Jump to dropped file
                    Writes a notice file (html or txt) to demand a ransom
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1025\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1028\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1029\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1030\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1031\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1032\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1033\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile dropped: C:\adc91a0e0132170ee1c9ace67d4b\1035\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-e5pgph03feprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0793lfyrgbm7az5zpjjggzygva9vfh6xpmk3xwjgrumtJump to dropped file

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 25.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 25.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 25.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 25.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 24.2.4A15.exe.43815a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 24.2.4A15.exe.43815a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 24.2.4A15.exe.43815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 24.2.4A15.exe.43815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 10.2.4A15.exe.44715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 10.2.4A15.exe.44715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 11.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 11.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.4260000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects OnlyLogger loader variants Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.4260000.0.unpack, type: UNPACKEDPEMatched rule: Detects OnlyLogger loader variants Author: ditekSHen
                    Source: 27.2.4A15.exe.43915a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 27.2.4A15.exe.43915a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 11.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 11.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 29.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 29.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: 27.2.4A15.exe.43915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 27.2.4A15.exe.43915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 10.2.4A15.exe.44715a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 10.2.4A15.exe.44715a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 29.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 29.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                    Source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                    Source: 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 00000024.00000002.541185132.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                    Source: 0000001B.00000002.521657270.00000000042E3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 0000001F.00000002.446630399.0000000002858000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                    Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 00000001.00000002.376743466.0000000002659000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                    Source: 00000007.00000002.428763684.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                    Source: 00000018.00000002.436833878.0000000004194000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects OnlyLogger loader variants Author: ditekSHen
                    Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: 00000007.00000002.428745109.00000000026D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                    Source: 00000024.00000002.531504418.0000000004625000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                    Source: 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 00000001.00000002.376709250.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                    Source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                    Source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                    Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                    Source: Process Memory Space: 4A15.exe PID: 4692, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: Process Memory Space: 4A15.exe PID: 3164, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: Process Memory Space: 4A15.exe PID: 5976, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: Process Memory Space: 4A15.exe PID: 6392, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: Process Memory Space: 4A15.exe PID: 2456, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: Process Memory Space: 4A15.exe PID: 2884, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1], type: DROPPEDMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
                    Source: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe, type: DROPPEDMatched rule: Detects RedLine infostealer Author: ditekSHen
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
                    Source: C:\Users\user\AppData\Local\Temp\BB52.exe, type: DROPPEDMatched rule: Detects downloader / injector Author: ditekSHen
                    PE file contains section with special chars
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_004254721_2_00425472
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_004240051_2_00424005
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_004269231_2_00426923
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00424F211_2_00424F21
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_004249D01_2_004249D0
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_004254727_2_00425472
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_004240057_2_00424005
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_004269237_2_00426923
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00424F217_2_00424F21
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_004249D07_2_004249D0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0447E6E010_2_0447E6E0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044BB69F10_2_044BB69F
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0447C76010_2_0447C760
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0449D7F110_2_0449D7F1
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0447B00010_2_0447B000
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0448F03010_2_0448F030
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044800D010_2_044800D0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044730F010_2_044730F0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0447B0B010_2_0447B0B0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044BE14110_2_044BE141
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0449D1A410_2_0449D1A4
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044BE37C10_2_044BE37C
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044B2D1E10_2_044B2D1E
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044A4E9F10_2_044A4E9F
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044918D010_2_044918D0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0448A93010_2_0448A930
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0449E9A310_2_0449E9A3
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0449F9B010_2_0449F9B0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0447CA1010_2_0447CA10
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_04472B6010_2_04472B60
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_04480B0010_2_04480B00
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0447DBE010_2_0447DBE0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040D24011_2_0040D240
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00427D6C11_2_00427D6C
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00419F9011_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040505711_2_00405057
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040C07011_2_0040C070
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0042E00311_2_0042E003
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0042F01011_2_0042F010
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040803011_2_00408030
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004070E011_2_004070E0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0041016011_2_00410160
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004C811311_2_004C8113
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004021C011_2_004021C0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004391F611_2_004391F6
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0043524011_2_00435240
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004C934311_2_004C9343
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0044237E11_2_0044237E
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040544711_2_00405447
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040545711_2_00405457
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004084C011_2_004084C0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004344FF11_2_004344FF
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0044950611_2_00449506
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0043E5A311_2_0043E5A3
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0044B5B111_2_0044B5B1
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040A66011_2_0040A660
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0043567511_2_00435675
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040968611_2_00409686
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0041E69011_2_0041E690
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040674011_2_00406740
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040275011_2_00402750
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040A71011_2_0040A710
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040F73011_2_0040F730
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040878011_2_00408780
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0044D7A111_2_0044D7A1
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0042C80411_2_0042C804
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040688011_2_00406880
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0048192011_2_00481920
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0044D9DC11_2_0044D9DC
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004349F311_2_004349F3
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004069F311_2_004069F3
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00449A7111_2_00449A71
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00443B4011_2_00443B40
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00402B8011_2_00402B80
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00406B8011_2_00406B80
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00409CF911_2_00409CF9
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0044ACFF11_2_0044ACFF
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040DD4011_2_0040DD40
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040BDC011_2_0040BDC0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00409DFA11_2_00409DFA
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0042CE5111_2_0042CE51
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00434E0B11_2_00434E0B
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00406EE011_2_00406EE0
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00409F7611_2_00409F76
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00420F3011_2_00420F30
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00449FE311_2_00449FE3
                    Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorybroker.dllJump to behavior
                    Source: C:\Windows\explorer.exeSection loaded: capauthz.dllJump to behavior
                    Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dllJump to behavior
                    Source: C:\Windows\explorer.exeSection loaded: npsmdesktopprovider.dllJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: lz32.dllJump to behavior
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: Number of sections : 15 > 10
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: Number of sections : 15 > 10
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: Number of sections : 15 > 10
                    Source: 1oYHJ3b1F3QrpZXBIXgl6loz.exe.18.drStatic PE information: Number of sections : 11 > 10
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: Number of sections : 15 > 10
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: Number of sections : 15 > 10
                    Source: WQ1sXS4A8SPQ3OH5qUwmsfK7.exe.18.drStatic PE information: Number of sections : 11 > 10
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: Number of sections : 15 > 10
                    Source: file.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 25.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 25.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 25.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 25.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 24.2.4A15.exe.43815a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 24.2.4A15.exe.43815a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 24.2.4A15.exe.43815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 24.2.4A15.exe.43815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 10.2.4A15.exe.44715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 10.2.4A15.exe.44715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 11.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 11.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.4260000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_OnlyLogger author = ditekSHen, description = Detects OnlyLogger loader variants
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.4260000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_OnlyLogger author = ditekSHen, description = Detects OnlyLogger loader variants
                    Source: 27.2.4A15.exe.43915a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 27.2.4A15.exe.43915a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 11.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 11.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.5.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 29.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 29.2.4A15.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: 27.2.4A15.exe.43915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 27.2.4A15.exe.43915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 10.2.4A15.exe.44715a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 10.2.4A15.exe.44715a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 29.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 29.2.4A15.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                    Source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                    Source: 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 00000024.00000002.541185132.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                    Source: 0000001B.00000002.521657270.00000000042E3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 0000001F.00000002.446630399.0000000002858000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                    Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 00000001.00000002.376743466.0000000002659000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                    Source: 00000007.00000002.428763684.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                    Source: 00000018.00000002.436833878.0000000004194000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_OnlyLogger author = ditekSHen, description = Detects OnlyLogger loader variants
                    Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: 00000007.00000002.428745109.00000000026D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                    Source: 00000024.00000002.531504418.0000000004625000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                    Source: 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 00000001.00000002.376709250.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                    Source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                    Source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                    Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                    Source: Process Memory Space: 4A15.exe PID: 4692, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: Process Memory Space: 4A15.exe PID: 3164, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: Process Memory Space: 4A15.exe PID: 5976, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: Process Memory Space: 4A15.exe PID: 6392, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: Process Memory Space: 4A15.exe PID: 2456, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: Process Memory Space: 4A15.exe PID: 2884, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1], type: DROPPEDMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
                    Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
                    Source: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe, type: DROPPEDMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
                    Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, type: DROPPEDMatched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
                    Source: C:\Users\user\AppData\Local\Temp\BB52.exe, type: DROPPEDMatched rule: MALWARE_Win_DLInjector04 author = ditekSHen, description = Detects downloader / injector
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 00428C81 appears 41 times
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 0042F7C0 appears 56 times
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 0044F23E appears 53 times
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 00428520 appears 74 times
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 04498EC0 appears 50 times
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 044A0160 appears 46 times
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: String function: 004547A0 appears 31 times
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00401558 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_00401558
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00401749 NtMapViewOfSection,NtMapViewOfSection,1_2_00401749
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_00401564
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_00401577
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00401523 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_00401523
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00401585 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_00401585
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_0040158C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_0040158C
                    Source: C:\Users\user\Desktop\file.exeCode function: 1_2_0040159A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,1_2_0040159A
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00401558 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_00401558
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00401749 NtMapViewOfSection,NtMapViewOfSection,7_2_00401749
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00401564 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_00401564
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00401577 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_00401577
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00401523 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_00401523
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_00401585 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_00401585
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_0040158C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_0040158C
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwCode function: 7_2_0040159A NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,7_2_0040159A
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_04470110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,10_2_04470110
                    Source: file.exeStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: 9315.exe.2.drStatic PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 983088 bytes, 2 files, at 0x2c +A "z1899051.exe" +A "w7735502.exe", ID 1711, number 1, 32 datablocks, 0x1503 compression
                    Source: D8E5.exe.2.drStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: 2D42.exe.2.drStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: 9117.exe.2.drStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: jwjrtuw.2.drStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: soa3mGK83PMJk1RZrnayLoiR.exe.18.drStatic PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
                    Source: mbsmLcWDGIknMhQtAUGQxRi5.exe.18.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                    Source: tJU5p8ys1whXWo8BDeT3nnmx.exe.18.drStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: sXkL3LKFhhFZp9IPDF60kufQ.exe.18.drStatic PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
                    Source: mdVqxBv1FXzpT51i7izhV1L3.exe.18.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                    Source: file.exe, 00000001.00000002.376679497.0000000002591000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameKujingle.exe2 vs file.exe
                    Source: 4A15.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 2629.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 9117.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 4A15.exe.11.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 3958.dll.2.drStatic PE information: Section: CODE ZLIB complexity 0.9980922965116279
                    Source: 25C8.dll.2.drStatic PE information: Section: CODE ZLIB complexity 0.9980922965116279
                    Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\jwjrtuwJump to behavior
                    Source: classification engineClassification label: mal100.rans.troj.spyw.expl.evad.winEXE@149/755@0/51
                    Source: C:\Windows\explorer.exeFile read: C:\Users\user\Searches\desktop.iniJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,11_2_00411900
                    Source: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization
                    Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                    Source: unknownProcess created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
                    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\jwjrtuw C:\Users\user\AppData\Roaming\jwjrtuw
                    Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe C:\Users\user\AppData\Local\Temp\4A15.exe
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe C:\Users\user\AppData\Local\Temp\4A15.exe
                    Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\3958.dll
                    Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\3958.dll
                    Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\A388.exe C:\Users\user\AppData\Local\Temp\A388.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe "C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe "C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe "C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe"
                    Source: unknownProcess created: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe "C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeProcess created: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe "C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe "C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe "C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe "C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe "C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe" /s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe "C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe"
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeProcess created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                    Source: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeProcess created: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp "C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp" /SL5="$1044C,4692544,832512,C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                    Source: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exeProcess created: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp "C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp" /SL5="$30434,491750,408064,C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                    Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe C:\Users\user\AppData\Local\Temp\4A15.exeJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\3958.dllJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\A388.exe C:\Users\user\AppData\Local\Temp\A388.exeJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe C:\Users\user\AppData\Local\Temp\4A15.exeJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f" /deny *S-1-1-0:(OI)(CI)(DE,DC)Jump to behavior
                    Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\3958.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe "C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe "C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe "C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe "C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe "C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe "C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe "C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe" /s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe "C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe "C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeProcess created: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task
                    Source: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeProcess created: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp "C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp" /SL5="$1044C,4692544,832512,C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeProcess created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                    Source: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exeProcess created: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp "C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp" /SL5="$30434,491750,408064,C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeProcess created: unknown unknown
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeProcess created: unknown unknown
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeProcess created: unknown unknown
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess created: unknown unknown
                    Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32Jump to behavior
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\4A15.tmpJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,11_2_0040D240
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A25000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.557010087.0000000003A29000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.631372323.0000000003A21000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A19000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.580765017.0000000003A2B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.450265651.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A1E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;xT
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.631372323.0000000003A21000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A19000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.624585849.0000000003A10000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;/x
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.580765017.0000000003A2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;H3
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A1E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;8D
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCA4000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT OSArchitecture FROM Win32_OperatingSystem.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCDriverData=C:\Windows\System32\Drivers\DriverData
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A25000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.557010087.0000000003A29000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A2C000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.529294566.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.546344384.0000000003A29000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.530724402.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;Pq
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.529294566.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.530724402.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;jl
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni.dll
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0429C7C6 CreateToolhelp32Snapshot,Module32First,10_2_0429C7C6
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeMutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6852:120:WilError_01
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: --Admin11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: IsAutoStart11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: IsTask11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: --ForNetRes11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: IsAutoStart11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: IsTask11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: --Task11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: --AutoStart11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: --Service11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: X1P11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: --Admin11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: runas11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: x2Q11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: x*P11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: C:\Windows\11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: D:\Windows\11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: 7P11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: %username%11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCommand line argument: F:\11_2_00419F90
                    Source: 4A15.exeString found in binary or memory: set-addPolicy
                    Source: 4A15.exeString found in binary or memory: id-cmc-addExtensions
                    Source: 4A15.exeString found in binary or memory: set-addPolicy
                    Source: 4A15.exeString found in binary or memory: id-cmc-addExtensions
                    Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeFile read: C:\Windows\System32\drivers\etc\hosts
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpWindow found: window name: TMainForm
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLL
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                    Source: C:\Users\user\Desktop\file.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpRegistry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{64F4736C-6169-4520-9368-BE1C9EAE552A}_is1
                    Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 00000002.00000000.376312472.00007FFC2B141000.00000020.00000001.01000000.00000005.sdmp
                    Source: Binary string: Loader.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\cr4shed\Desktop\MyHealthLoader\obj\Debug\MyHealthLoader.pdb source: 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.0000000003735000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: EfiGuardDxe.pdb7 source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmp
                    Source: Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Age does not matchThe module age and .pdb age do not match. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: symsrv.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000C79000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000005369000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: SetupUtility.pdb source: 4A15.exe, 00000019.00000003.473464201.0000000009A20000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: Downloading symbols for [%s] %ssrv*symsrv*http://https://_bad_pdb_file.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Setup.pdb source: 4A15.exe, 00000019.00000003.473294254.0000000009A20000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 4A15.exe, 4A15.exe, 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                    Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Magnify.pdb source: 4A15.exe, 00000019.00000003.526084395.0000000003170000.00000004.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000000.437080358.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.683131767.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp
                    Source: Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 00000002.00000000.376312472.00007FFC2B141000.00000020.00000001.01000000.00000005.sdmp
                    Source: Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Drive not readyThis error indicates a .pdb file related failure. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Magnify.pdb@WH source: 4A15.exe, 00000019.00000003.526084395.0000000003170000.00000004.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000000.437080358.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.683131767.00007FF77A411000.00000020.00000001.01000000.0000000F.sdmp
                    Source: Binary string: mscorlib.pdb source: 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.0000000003735000.00000004.00000800.00020000.00000000.sdmp
                    Source: Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: Unable to locate the .pdb file in this location source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: The module signature does not match with .pdb signature. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: .pdb.dbg source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: '(EfiGuardDxe.pdbx source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: symsrv.pdbGCTL source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000C79000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000005369000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: or you do not have access permission to the .pdb location. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: EfiGuardDxe.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 4A15.exe, 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                    Source: Binary string: eex.pdb source: explorer.exe, 00000002.00000000.376312472.00007FFC2B141000.00000020.00000001.01000000.00000005.sdmp
                    Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb0pH| source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmp
                    Source: Binary string: SetupUtility.pdb5 source: 4A15.exe, 00000019.00000003.473464201.0000000009A20000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: Signature does not matchThe module signature does not match with .pdb signature source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: dbghelp.pdb source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp
                    Source: Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb source: V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmp
                    Source: Binary string: dbghelp.pdbGCTL source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmp

                    Data Obfuscation

                    barindex
                    Detected unpacking (overwrites its own PE header)
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeUnpacked PE file: 11.2.4A15.exe.400000.0.unpack
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeUnpacked PE file: 25.2.4A15.exe.400000.0.unpack
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeUnpacked PE file: 29.2.4A15.exe.400000.0.unpack
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeUnpacked PE file: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeUnpacked PE file: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack
                    Detected unpacking (changes PE section rights)
                    Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 1.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwUnpacked PE file: 7.2.jwjrtuw.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeUnpacked PE file: 11.2.4A15.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeUnpacked PE file: 25.2.4A15.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeUnpacked PE file: 29.2.4A15.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeUnpacked PE file: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeUnpacked PE file: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeUnpacked PE file: 37.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
                    Detected unpacking (creates a PE file in dynamic memory)
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeUnpacked PE file: 26.2.i4PHS5R0iEKcuu4uBuaRKA3v.exe.3840000.2.unpack
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0429F0AF push ecx; retf 10_2_0429F0B2
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_04498F05 push ecx; ret 10_2_04498F18
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00428565 push ecx; ret 11_2_00428578
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,11_2_00412220
                    Source: mbsmLcWDGIknMhQtAUGQxRi5.exe.18.drStatic PE information: 0xC9989FCF [Sat Mar 6 02:19:59 2077 UTC]
                    Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\3958.dll
                    Source: A388.exe.2.drStatic PE information: section name: _RDATA
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name:
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .themida
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: uYMXNl5sSvaZoW3VwBNxI0U7.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name:
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .themida
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: P94EhV34EPtPaMGwUp1MdOBl.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: yRbowIjZdxellWMLi8kEb6gJ.exe.18.drStatic PE information: section name: .sxdata
                    Source: WQ1sXS4A8SPQ3OH5qUwmsfK7.exe.18.drStatic PE information: section name: .xdata
                    Source: 1oYHJ3b1F3QrpZXBIXgl6loz.exe.18.drStatic PE information: section name: .xdata
                    Source: GlKtZqXQAiyhJM8NCtTVvYcF.exe.18.drStatic PE information: section name: .sxdata
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name:
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .themida
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: opugKRO9HQIQrHGr6X89OLro.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name:
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .themida
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: AboFkE91gGtC0jX22BS3GOn1.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name:
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .themida
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: SPpYvykupaNYuUQqOkv0xHw6.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip0
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name:
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .themida
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip1
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip2
                    Source: flZM696vxwchmoky86e6PuiE.exe.18.drStatic PE information: section name: .7-Zip3
                    Source: initial sampleStatic PE information: section where entry point is pointing to: .7-Zip3
                    Source: 3958.dll.2.drStatic PE information: real checksum: 0x0 should be: 0x1a31a3
                    Source: Ba6UF83A2hR7tzyyn3dRNO2C.exe.18.drStatic PE information: real checksum: 0xa3638 should be: 0xa2a18
                    Source: A388.exe.2.drStatic PE information: real checksum: 0x0 should be: 0x4b724
                    Source: grenEgiZiRLW7ypJuIUqFvJB.exe.18.drStatic PE information: real checksum: 0x0 should be: 0xbdb4d
                    Source: dBv3dMkRlgVVDPZTZMyWgdJN.exe.18.drStatic PE information: real checksum: 0xa3638 should be: 0xa2a18
                    Source: GlKtZqXQAiyhJM8NCtTVvYcF.exe.18.drStatic PE information: real checksum: 0x0 should be: 0x732447
                    Source: mdVqxBv1FXzpT51i7izhV1L3.exe.18.drStatic PE information: real checksum: 0x0 should be: 0x31a2ef
                    Source: BB52.exe.2.drStatic PE information: real checksum: 0x0 should be: 0x68ec7b
                    Source: uGG02PvwRtGMBgiPW7q8rUhy.exe.18.drStatic PE information: real checksum: 0x0 should be: 0xbdb4d
                    Source: 1oYHJ3b1F3QrpZXBIXgl6loz.exe.18.drStatic PE information: real checksum: 0x53ba61 should be: 0x5429d6
                    Source: mbsmLcWDGIknMhQtAUGQxRi5.exe.18.drStatic PE information: real checksum: 0x0 should be: 0x31a2ef
                    Source: yRbowIjZdxellWMLi8kEb6gJ.exe.18.drStatic PE information: real checksum: 0x0 should be: 0x732447
                    Source: WQ1sXS4A8SPQ3OH5qUwmsfK7.exe.18.drStatic PE information: real checksum: 0x53ba61 should be: 0x5429d6
                    Source: 25C8.dll.2.drStatic PE information: real checksum: 0x0 should be: 0x1a31a3
                    Source: initial sampleStatic PE information: section name: .text entropy: 7.508633480574993
                    Source: initial sampleStatic PE information: section name: .text entropy: 7.508356543362123
                    Source: initial sampleStatic PE information: section name: .text entropy: 7.508673631423719
                    Source: initial sampleStatic PE information: section name: .text entropy: 7.508633480574993
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\jwjrtuwJump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]Jump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s51[1]Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\eKHEatA2YHjGupA41pjTqd4Q.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\CluIFFuzrOPmXrVReYWFXWkl.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\w6vQnvc6GcufcSoPXxqtk9pf.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\KK8iAf5MAhkTAWCxUa0tQFbr.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\grenEgiZiRLW7ypJuIUqFvJB.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\WQ1sXS4A8SPQ3OH5qUwmsfK7.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\gTtQqHKsFf9Nsh1JcOtwF10p.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\qzThW72RYcWSkAonVKQR5Zam.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\9fmETiwrp9mvcT9QPdRrgON5.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\jNWzuOIBQ0iWSRmcZK1mILW4.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\QmwuUY15y0L4DcEZ4ogFMHTp.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\iPhp3cV97VGJ34Ref6E2pORE.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Setup.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\BYpvSgsqBQF2e9VWX5DwhO9b.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\45jOwggrSgiiBeW99lMmxS6j.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\wIL2ZlmqVCEy0oDKdGcGn17c.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\C88Sh505pu9bIEkUIPtIAuGY.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\4A15.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\PgD7qvCHGXafJKVwvHiAw9cK.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\uusesdQ3Edo2k5kNA0mkf5gw.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\qdXZz0xbr8NxLE1KImKm0Ewp.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\TDwHwUnikC3d4IvKdWZ8TN8E.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\3e7TFXuOpvanKkAtgXUBsjg5.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\KW0cvO7X0axYcWEJHf74m4I5.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\u0apTRIaaBzfoydgvcDO3D8B.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\gFd0eLtQK8YMDxXc1BQkGeep.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\mbsmLcWDGIknMhQtAUGQxRi5.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\SGRGSrOrLAvbIwSiEaRMIm3Y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\TNzDEBB9FdUrEB9ZmBfj0vTU.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\CxjHTt9L9FL0XO680gDmLj9t.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\HZmkan0RtnpmEbbLPyds7uQ6.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\pAN917faLxSCNhjrt1Tur9pL.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\DuDMa6rOf5SGixuVkls53BX0.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\dl0eBw1a4nselM03kEjNFUeZ.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\LOFVsBSZANM2Xmh0aztGpxRj.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\JNxHITgt9Gfgxa9zzN5RQgfc.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\BB52.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\uYMXNl5sSvaZoW3VwBNxI0U7.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\gcwSzukTSrGmCgHPurGZSV7G.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\opugKRO9HQIQrHGr6X89OLro.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\dHxqqbbMHpGRP1KlVseWr6lF.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\HtIo7KIXeXJCj2oA9gjrZLg4.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\gdGlSTAHRx5XYnptuFFvfF3Y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\d4dL2ywdYIMevGjO45NXflQu.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\8jjMtFTS9Zlbf6vKPpWxHhte.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\dl0eBw1a4nselM03kEjNFUeZ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\zXDbhoHyWUFQr5mr9s8YwHsD.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\q1a6Hdte5ZphUujirBwwpHRY.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\RoYVZz1e4yTRTjOZHXj4zqUM.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\X91wRWDPO4snjUjOgZjUlicT.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\qX5oeRRpM2S4qHilS3yTr7sq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\sPCxEY41osSQyAztFqDas2bV.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\C88Sh505pu9bIEkUIPtIAuGY.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\DigitalPulse\is-0SIDM.tmpJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\AboFkE91gGtC0jX22BS3GOn1.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\DuDMa6rOf5SGixuVkls53BX0.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\Ba6UF83A2hR7tzyyn3dRNO2C.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\fwfQo65WjnmzC07yXHDaETw8.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\P94EhV34EPtPaMGwUp1MdOBl.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\lWqXWTOTj5tqRWB7LrSzEOfi.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\mqdlYa5XIp88le49pQN6WBpM.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\SVKcZYT3TwUPvLXOcZVQMjWE.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\SetupUtility.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\Rh0zrbuPE23tmioMFpoeQvyq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\OdBy5UCgwCs2zOQ5hgwqYDDW.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\9117.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\TtG5py94KsXzXSkP3RqVlzUB.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseService.exe (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\A388.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\Zm8A45fXl2ofLOUYJkU9Hc7y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\ex3hWoysxxQp9yfxr1vhsCEu.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\hduocco6pWLP0HaA9bgAhije.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\ghXDF7wc1k0lMAVWTQE9mN9d.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\iTvsD7rneILjrgO7TrPXhsJG.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\OoqQROwr1Yg6cLi95suPlaEZ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\uHshgHc7dTYJxuLdXX1zGE4V.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\TDwHwUnikC3d4IvKdWZ8TN8E.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\0EM9MRJYNgaQ4VquhLvMZCs2.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\GYngh8EVUEw76N8T1NO6LHCp.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\sXkL3LKFhhFZp9IPDF60kufQ.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\DigitalPulse\is-VGBL0.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\MAq6dYMqMOp7jsSy8ZTXM3iM.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\ekOUFFIwIeDOzbw9eNWrMi30.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\PQupt0HW1Hr6CvQnLIpAX9Nn.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\u0apTRIaaBzfoydgvcDO3D8B.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseUpdate.exe (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\3zaREjkJ8eT5V6QYRyuztw7a.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\cS0SutwWZwoWvtpaGLPFoC2y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\ndfd6Kq0UsE3T3ImvDCKwi8c.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\RMGQS3F1UiPheVnWeV2JpDqL.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\z2jspOJECx7C1xJp0mXk8tDq.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\KvSnRxw7nRoWWzdlM6L4ADmH.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Setup.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\WMMeMLRqjSsdlkGClauVg3Va.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\GKjBUOzHFWuZkPSfpmsGrIXJ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\LFQuJgUFeCErm0Je4c8RfLzf.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\GXEmL9Hio2yqAqGb8rDpNfoq.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\MAq6dYMqMOp7jsSy8ZTXM3iM.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\nG1N9nGRo8GAvgDDfFLRMM5E.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\DigitalPulse\unins000.exe (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\dBv3dMkRlgVVDPZTZMyWgdJN.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build2[1].exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\xmJBaRtKA9fm4EreSTrCxLrH.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\jkJntnUiFKCYlUk0tBLKBOQE.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\flZM696vxwchmoky86e6PuiE.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\en2Jyn1qg7jEGhbzerb4PGCA.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\PWW3NllpNWDgvXFV7Tah5Tq9.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\3958.dllJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\F58q5AtuSb0KXmkDjDm8UY4r.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\xWzXbvgqSclHLdENdr90zH0e.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\w6vQnvc6GcufcSoPXxqtk9pf.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\zUUHNzh5T8q1lb1rXsANRm0p.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\XxaWUuSPH3Fo3U3cdFyCwDfN.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\qvQF1TKYhYFFgSpHGD6rgb7v.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\soa3mGK83PMJk1RZrnayLoiR.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\Qf1uzkxmrsAEWK29C7uEFmrZ.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\2629.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\DigitalPulse\is-KJIQ4.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\SetupUtility.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\O4TFp27C2n3WSIh4cH9WqD5A.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\tJU5p8ys1whXWo8BDeT3nnmx.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\NjXePrSynHsARTml2YUxC7hl.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\jwjrtuwJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\rdOeLIubzEtA5kaQGojFXfzi.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\l4NNL3d0gUhzOZ4YXgbQgdkt.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\uGG02PvwRtGMBgiPW7q8rUhy.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\hypYBFCjte80ItmGLKdfXKZ2.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\SPpYvykupaNYuUQqOkv0xHw6.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\lPklOteJSGW2ZOcLzoL339u4.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\GlKtZqXQAiyhJM8NCtTVvYcF.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\lCgtZ6E4HkEVDH0ClzJMZwZY.exeJump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\fyRhz339Pv56oNzsjdndKi51.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\rOWY7QA6HmKaReenlQLKGBVq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\Uj24luzqBnidcXyEK0ccsV0u.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\90MmY3vsUc9ABzZegEZBdNOJ.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\dHxqqbbMHpGRP1KlVseWr6lF.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\tIomxm3YzHufqxsKHNVvwAcF.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\mdVqxBv1FXzpT51i7izhV1L3.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\KbXck5SLdtiTd8Kvi7iaPG3v.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\YXm3NwMNdpjawwYFNXTrNGEs.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\D8E5.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\c8KXUlVEBLWKm0FvrBR7FzOQ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\WzFp4Ue0aRPtu9AGKLArlpQs.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\TUpbZ8vU8BuCVac1Gcxet4HJ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\zB0tyM6N8N1lhBO2ZyVBkpB0.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\Tc3J3MYPBvAb1zFAQ5lDv3bp.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\MgZKvMc7DV5RedICsSIU2R0o.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\gIwaldePRmh9KRuICLUyfpks.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\yRbowIjZdxellWMLi8kEb6gJ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\RhAMzHnnu31IkY36iE1sZ1J2.exeJump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s51[1]Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\zDIXJhMuVzNtJxExlDXABWMh.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\r7udPMXlAvzgwc1HpIoaUJHs.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\cIYKpG6eQ8E5shW60pciCDk9.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\iCCTvyp70q0GmXWM7T6SbAw3.exeJump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeFile created: C:\Users\user\AppData\Local\Temp\5838081746.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\szKukjqbkrhlE2n6dTEMyu9d.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\wlmRug0KapvbPX1WnJ7a9tAS.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\2D42.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\t1VMdyrwrvacSZR05WqVdNos.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\PEETw0QK3zD9r7HEE5AR45AO.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\kCzd2hvmIWrMuzzglfLDz5jN.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\25C8.dllJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\qzThW72RYcWSkAonVKQR5Zam.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\ZOi0qzxm5CX6wQOzSpSM9xKZ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\uusesdQ3Edo2k5kNA0mkf5gw.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exeJump to dropped file
                    Source: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exeFile created: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmpJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\UZMd9akv_Vfb8MG5RwDjTpGs.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\3Q13EXxFz2FZ8WAMgsOWhK6Y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\46ajs7POqByEYUKIKWz4ttVU.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\18TZ4GlEcXROaMlzQyxlot37.exeJump to dropped file
                    Source: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeFile created: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\mGx41hPeYElMLjZ4bbI9SOQq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\RblTvSwpBJ357KsApRz6smyw.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\2OoGOAjocmnrCO0Kg3mdJjGT.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\3DW8qUWA963x8XKarJJ0WTU1.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\KvSnRxw7nRoWWzdlM6L4ADmH.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\UZMd9akv_Vfb8MG5RwDjTpGs.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\XxaWUuSPH3Fo3U3cdFyCwDfN.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\Minor Policy\GXEmL9Hio2yqAqGb8rDpNfoq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\SXfcayqkk1DZ7GAEIik6FBEC.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\nlZXac1d8FE86X98ibImDWvF.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\4b20TTfioBavoCXVhZH8FlIL.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\DFhwCIhHEDQ5pEOtcRuwyHkl.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\Pictures\OoqQROwr1Yg6cLi95suPlaEZ.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Local\Temp\is-N0LK6.tmp\_isetup\_setup64.tmpJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\t0EOMhSnTVCOCZS9qZwimCQw.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\cDbEZELclwHIblfubBb7q5VJ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeJump to dropped file
                    Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\9315.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\G2DNcZFdbZ5vEmNAUVLs9Ohf.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\X4G1qMGsevrGDCsTxtK3q3TA.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\Mrqt0LPomy7YxUAwjV5w1C4Z.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\8XubnCv1993Zn4FRUL2X67x0.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Local\9rjyJ5VsLUcAN5cWEKCTLeAn.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\v5b6ykiuRrf9juwnW3RUfpyP.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\Pictures\1oYHJ3b1F3QrpZXBIXgl6loz.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1025\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1028\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1029\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1030\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1031\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1032\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1033\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1035\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1036\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1037\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1038\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1040\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1041\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1042\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1043\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1044\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1045\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1046\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1049\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1053\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\1055\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2052\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\2070\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\3082\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\adc91a0e0132170ee1c9ace67d4b\Graphics\_readme.txt
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeFile created: C:\Users\user\_readme.txt

                    Boot Survival

                    barindex
                    Creates multiple autostart registry keys
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DigitalPulse
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelperJump to behavior
                    Drops script or batch files to the startup folder
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cT1woQpizC6vcsIhG30ZQlQi.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T84nsKO1CTEA0v5s172Ng97O.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rJML2qbU2x4efJRvXQmhf8RZ.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zQTzjmsbagDNgxuMxxvWCD8k.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ogS6GI971UbwFUMRvTH526Ng.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o7Ltlgbuhc2pTKM6VdDLYPeY.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cqnfn7K2uSSgR0BK2dmSG6RT.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmuO211gYTn8iCs01aaXkTed.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mgdvdw3c1wBKaXMXrb2EOv9W.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bMV0AJsrIFEu61FsUzZ3Drg4.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mDbURsIxi4UnUxZyhZbmGv8D.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0bUmj41QzTFKxcsKeTSfKkOO.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmnJRByvDUkcoP7wAlcOz4fD.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jg7MBx8Eimj9jzWN7SGXgCPJ.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exzdtm0wZNhsJNbT7QPWRUFE.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EqPIdUUlTMy5tQLkxM9fn0Ae.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DZNdMDc7jqkeF9bqdtQef9yM.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIDZnNdiQJAaINi14fIkmT0h.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YCn5gwEDkBtWGFrNNMijrH2o.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYHdYGipdDukoUN4vtDtIoGo.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zwMxzFEl9AYYdEJnYuMrZFRE.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Q4EkPjCkxeFEQ1Eatt9Dwxh.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jU9C5BnteHyTc9SaNrtdcXLF.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pffVw7spgUfcbHvL0goxMzxQ.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K0dzfudLJ4R9jr53jDBveT1d.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5FHiG1jFHMv7GsPhOUzodwEo.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OJIkGrj7wa8sdrCAl5rVAqI7.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iwDuhOuTh3OumoPBD4ROUdv1.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PiUS4qsAk3nJglYx9uYKTWKM.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gEatP5rYPHhzi7hzLCguIIkD.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVSZ5f8OUEP7i1ry4oDQSxqU.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S4tcLQiJwRoe30tH0sEtEDOs.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4DG0XAULkG4rtQXtfX3kCH5m.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UdmZfQQ5qXAW8NHTfIDGE6mL.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwwZiWJtqiPyuHGdDeQvFFlw.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nHOXbHeygi9ejoq1v86AFvdZ.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yYAGJkr1nyEU0XfzTRSj3Pt8.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trQ9bZRspPuCYbV3WtPprw6Q.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mA4Aqg8LeqPlIO7zNJ1CDIlw.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doYPozeGIFDZmObCagCEQLu8.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aNUjsDMzxrUZ9pMyOMHt7aH1.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KTEYXtNqiWcY5UFNzSqYDslr.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PB9LzXES4aybf4XF2Nl44BCv.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OLS2gd5i4fNCKRL2gGt0JX1k.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zM2HPwdlDIpliCdYrSbuLgMc.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fTbmVIx9tHa82q2Xw16exu7m.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dtKs2tS72ZiQUqQJbm6PlXNn.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MpI6yHPMnpE9wO0VLneXkBvT.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qquxvpgTE06quf47P6Hr5Hix.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OEQ6K9YiI6P1luZke1R8ZVud.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fMA6KEnRS3bOmy31UfZkaOcX.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62l33e7HUe40sAbIBogbEpmM.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcCVWu7ZYHEafDMGCkY7sR2G.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QIttVglwj2HtPQeFbGsTsTBG.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M7S73t6hBdZDj23RDOUIkddh.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M6d7Epczs7g4ly9ridfMV5Um.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\orm1tV5mrVJ5E8pEGOQYpSH9.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pZRcD6tlAQ9BuiAybpYpvOsT.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qV5iTvTL8Sj2XqX5shxpgs1m.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yvdmir6PCG9PcsgBUQPDicbH.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9VF2IVEsQy2wXp3Fmzr839j.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YPBkrWCoxboqSNx8lEtAyzJ0.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vrHkwSzKoIdyE31xmdhdzW9.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rVQy8crS1kFmaQTOJgtusLjN.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yq4chNFGYAkyzyEdaZH2HqIK.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qsHLHdmkHFgmHHWZoRJcEBWJ.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QETfbaDRTdtgjhXvrYD8MQH8.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oKpQkZx8V8ZMmplldvhOMwLF.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VhTJ6AtzebMaD1wtY1ld826g.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATKKHBDhrRJwctnRcnUm6Pcg.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LHEl0niwjoltQS39V2LJgECA.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F0wBxbY5f5DKwVnQVeO4owaC.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sa989uESZtC2k5fPxh7JOAOo.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aflaw6AZSGKIe0s45Bz4rgPm.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E7Idc4Rv0o4k8F06OBpETIIR.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xc8ndnBgtKiEp95qA74vXtJn.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ft6shQtleq2YoP6uxtjELNIa.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DdEpoZZi4YOh4OnfrVdHElZb.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FjkoyI2B9AB48Ezj9TYV0Ahw.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eGd4n9cCkUYchxkeXTXmdykg.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nQPwDzQPxeP9tbtTOADsUnQS.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hiUMZ8f6oKK1xINDp3JWAlOW.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dOE732BLSg0lcFC2QsLbsVdq.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\upUS4SXwlCEkOWrOaZRg0iWx.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWy61aGHvYMDcW2BYZLaPgOc.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Lfhv80yjQqPZSzTm3yFdWPF.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cnjktv5SHVaWkmg93IvmjT0w.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XkIN41cGFrm9aGL6NKqH1FLp.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g66AQFpQYrLlKLwe8BD5OCfh.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\745tzE4k357KTJX9XrGihSFX.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7LUSH97ozicm8oSAzFzv30fB.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UdKSHjICWNJimHBknLaPjXaz.batJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QIttVglwj2HtPQeFbGsTsTBG.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M7S73t6hBdZDj23RDOUIkddh.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M6d7Epczs7g4ly9ridfMV5Um.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yq4chNFGYAkyzyEdaZH2HqIK.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qsHLHdmkHFgmHHWZoRJcEBWJ.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QETfbaDRTdtgjhXvrYD8MQH8.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LHEl0niwjoltQS39V2LJgECA.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F0wBxbY5f5DKwVnQVeO4owaC.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sa989uESZtC2k5fPxh7JOAOo.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aflaw6AZSGKIe0s45Bz4rgPm.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FjkoyI2B9AB48Ezj9TYV0Ahw.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nQPwDzQPxeP9tbtTOADsUnQS.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\upUS4SXwlCEkOWrOaZRg0iWx.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dOE732BLSg0lcFC2QsLbsVdq.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWy61aGHvYMDcW2BYZLaPgOc.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Lfhv80yjQqPZSzTm3yFdWPF.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cnjktv5SHVaWkmg93IvmjT0w.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XkIN41cGFrm9aGL6NKqH1FLp.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g66AQFpQYrLlKLwe8BD5OCfh.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\745tzE4k357KTJX9XrGihSFX.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7LUSH97ozicm8oSAzFzv30fB.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UdKSHjICWNJimHBknLaPjXaz.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KTEYXtNqiWcY5UFNzSqYDslr.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rVQy8crS1kFmaQTOJgtusLjN.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DdEpoZZi4YOh4OnfrVdHElZb.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eGd4n9cCkUYchxkeXTXmdykg.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fTbmVIx9tHa82q2Xw16exu7m.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hiUMZ8f6oKK1xINDp3JWAlOW.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iwDuhOuTh3OumoPBD4ROUdv1.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fMA6KEnRS3bOmy31UfZkaOcX.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcCVWu7ZYHEafDMGCkY7sR2G.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pZRcD6tlAQ9BuiAybpYpvOsT.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yvdmir6PCG9PcsgBUQPDicbH.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YPBkrWCoxboqSNx8lEtAyzJ0.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vrHkwSzKoIdyE31xmdhdzW9.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oKpQkZx8V8ZMmplldvhOMwLF.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VhTJ6AtzebMaD1wtY1ld826g.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATKKHBDhrRJwctnRcnUm6Pcg.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E7Idc4Rv0o4k8F06OBpETIIR.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xc8ndnBgtKiEp95qA74vXtJn.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ft6shQtleq2YoP6uxtjELNIa.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mgdvdw3c1wBKaXMXrb2EOv9W.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mDbURsIxi4UnUxZyhZbmGv8D.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmnJRByvDUkcoP7wAlcOz4fD.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exzdtm0wZNhsJNbT7QPWRUFE.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DZNdMDc7jqkeF9bqdtQef9yM.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YCn5gwEDkBtWGFrNNMijrH2o.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYHdYGipdDukoUN4vtDtIoGo.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Q4EkPjCkxeFEQ1Eatt9Dwxh.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pffVw7spgUfcbHvL0goxMzxQ.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OJIkGrj7wa8sdrCAl5rVAqI7.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVSZ5f8OUEP7i1ry4oDQSxqU.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S4tcLQiJwRoe30tH0sEtEDOs.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4DG0XAULkG4rtQXtfX3kCH5m.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UdmZfQQ5qXAW8NHTfIDGE6mL.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwwZiWJtqiPyuHGdDeQvFFlw.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nHOXbHeygi9ejoq1v86AFvdZ.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yYAGJkr1nyEU0XfzTRSj3Pt8.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trQ9bZRspPuCYbV3WtPprw6Q.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mA4Aqg8LeqPlIO7zNJ1CDIlw.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doYPozeGIFDZmObCagCEQLu8.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aNUjsDMzxrUZ9pMyOMHt7aH1.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PB9LzXES4aybf4XF2Nl44BCv.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OLS2gd5i4fNCKRL2gGt0JX1k.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zM2HPwdlDIpliCdYrSbuLgMc.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dtKs2tS72ZiQUqQJbm6PlXNn.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MpI6yHPMnpE9wO0VLneXkBvT.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qquxvpgTE06quf47P6Hr5Hix.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OEQ6K9YiI6P1luZke1R8ZVud.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62l33e7HUe40sAbIBogbEpmM.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\orm1tV5mrVJ5E8pEGOQYpSH9.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qV5iTvTL8Sj2XqX5shxpgs1m.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9VF2IVEsQy2wXp3Fmzr839j.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cT1woQpizC6vcsIhG30ZQlQi.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T84nsKO1CTEA0v5s172Ng97O.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rJML2qbU2x4efJRvXQmhf8RZ.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zQTzjmsbagDNgxuMxxvWCD8k.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ogS6GI971UbwFUMRvTH526Ng.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o7Ltlgbuhc2pTKM6VdDLYPeY.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cqnfn7K2uSSgR0BK2dmSG6RT.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmuO211gYTn8iCs01aaXkTed.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bMV0AJsrIFEu61FsUzZ3Drg4.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0bUmj41QzTFKxcsKeTSfKkOO.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jg7MBx8Eimj9jzWN7SGXgCPJ.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EqPIdUUlTMy5tQLkxM9fn0Ae.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIDZnNdiQJAaINi14fIkmT0h.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zwMxzFEl9AYYdEJnYuMrZFRE.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jU9C5BnteHyTc9SaNrtdcXLF.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K0dzfudLJ4R9jr53jDBveT1d.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5FHiG1jFHMv7GsPhOUzodwEo.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PiUS4qsAk3nJglYx9uYKTWKM.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gEatP5rYPHhzi7hzLCguIIkD.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f0mlloe6MNO2zJGgbuLGKn4f.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79IZzBPQMZL8GZZYbkeNKnfs.bat
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hjURrOnfsa0JouNKaF4NqaVe.bat
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalPulse
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalPulse\DigitalPulse.lnk
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QIttVglwj2HtPQeFbGsTsTBG.bat
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelperJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelperJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DigitalPulse
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DigitalPulse

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Deletes itself after installation
                    Source: C:\Windows\explorer.exeFile deleted: c:\users\user\desktop\file.exeJump to behavior
                    Hides that the sample has been downloaded from the Internet (zone.identifier)
                    Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Roaming\jwjrtuw:Zone.Identifier read attributes | deleteJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00427D6C RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,11_2_00427D6C
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmpRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
                    Source: file.exe, 00000001.00000002.376731132.0000000002648000.00000004.00000020.00020000.00000000.sdmp, jwjrtuw, 00000007.00000002.428752132.00000000026EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ASWHOOK
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
                    Checks if the current machine is a virtual machine (disk enumeration)
                    Source: C:\Users\user\Desktop\file.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
                    Tries to detect sandboxes / dynamic malware analysis system (file name check)
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: \KnownDlls32\sElF.exEJump to behavior
                    Source: C:\Windows\explorer.exe TID: 6684Thread sleep time: -59400s >= -30000sJump to behavior
                    Source: C:\Windows\explorer.exe TID: 6676Thread sleep time: -109400s >= -30000sJump to behavior
                    Source: C:\Windows\explorer.exe TID: 4288Thread sleep time: -660000s >= -30000sJump to behavior
                    Source: C:\Windows\explorer.exe TID: 2044Thread sleep time: -46300s >= -30000sJump to behavior
                    Source: C:\Windows\explorer.exe TID: 7456Thread sleep time: -30300s >= -30000sJump to behavior
                    Source: C:\Windows\System32\svchost.exe TID: 6972Thread sleep time: -90000s >= -30000sJump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -18446744073709540s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -600000s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3532Thread sleep count: 4105 > 30
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3532Thread sleep count: 4497 > 30
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599872s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599765s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599657s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599532s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599407s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599282s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599157s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -599029s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598922s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598797s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598672s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598547s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598421s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598313s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598204s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -598079s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597954s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597844s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597719s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597610s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597485s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597360s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597235s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -597110s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596985s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596860s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596735s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596604s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596485s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596360s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596233s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -596107s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -595938s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -595799s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -595641s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -595344s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -595110s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -594856s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -594672s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -594485s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -594296s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -594094s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -593860s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5460Thread sleep time: -900000s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -593610s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -593344s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -593141s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -592954s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -592790s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -592554s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -592351s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -592132s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -591979s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -591523s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -591356s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -590934s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -590315s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -590127s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -589929s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -589789s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -589622s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -589305s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -588852s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -588652s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -588308s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -588027s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -587869s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -587415s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -587009s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -586228s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -585949s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -585661s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -585458s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -585207s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -584962s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -584040s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -583228s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -583103s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582965s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582855s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582726s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582579s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582440s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582291s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582177s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -582054s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581935s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581815s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581685s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581551s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581421s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581300s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -581157s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580944s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580822s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580708s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580581s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580436s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580310s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -580141s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -579885s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -579668s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -579355s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -579215s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -579034s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -578829s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -578703s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -578549s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -578364s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -578160s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -577932s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -577761s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -577584s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -577322s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -577182s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -577066s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -576931s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -576809s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -576486s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -576236s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -576103s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575944s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575827s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575695s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575567s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575432s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575308s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575186s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -575074s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -574917s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -574758s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -574565s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -574442s >= -30000s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1828Thread sleep time: -574293s >= -30000s
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exe TID: 5468Thread sleep time: -700000s >= -30000s
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe TID: 6868Thread sleep time: -3300000s >= -30000s
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe TID: 5704Thread sleep time: -6456360425798339s >= -30000s
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe TID: 5704Thread sleep time: -30000s >= -30000s
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe TID: 5480Thread sleep time: -90000s >= -30000s
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeLast function: Thread delayed
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeLast function: Thread delayed
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_11-40743
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 600000
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599872
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599765
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599657
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599532
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599407
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599282
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599157
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599029
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598922
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598797
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598672
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598547
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598421
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598313
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598204
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598079
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597954
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597844
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597719
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597610
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597485
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597360
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597235
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597110
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596985
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596860
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596735
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596604
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596485
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596360
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596233
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596107
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595938
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595799
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595641
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595344
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595110
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594856
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594672
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594485
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594296
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594094
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593860
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 300000
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593610
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593344
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593141
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592954
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592790
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592554
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592351
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592132
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 591979
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 591523
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 591356
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 590934
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 590315
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 590127
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589929
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589789
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589622
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589305
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588852
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588652
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588308
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588027
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 587869
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 587415
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 587009
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 586228
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585949
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585661
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585458
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585207
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 584962
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 584040
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 583228
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 583103
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582965
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582855
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582726
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582579
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582440
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582291
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582177
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582054
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581935
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581815
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581685
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581551
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581421
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581300
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581157
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580944
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580822
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580708
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580581
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580436
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580310
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580141
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579885
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579668
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579355
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579215
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579034
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578829
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578703
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578549
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578364
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578160
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577932
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577761
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577584
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577322
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577182
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577066
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576931
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576809
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576486
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576236
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576103
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575944
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575827
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575695
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575567
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575432
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575308
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575186
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575074
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574917
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574758
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574565
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574442
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574293
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeThread delayed: delay time: 700000
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeThread delayed: delay time: 300000
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 454Jump to behavior
                    Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 594Jump to behavior
                    Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 1094Jump to behavior
                    Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 463Jump to behavior
                    Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 597Jump to behavior
                    Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 595Jump to behavior
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: threadDelayed 4105
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: threadDelayed 4497
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeWindow / User API: threadDelayed 6836
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\w6vQnvc6GcufcSoPXxqtk9pf.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build2[1].exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\WQ1sXS4A8SPQ3OH5qUwmsfK7.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\gTtQqHKsFf9Nsh1JcOtwF10p.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\flZM696vxwchmoky86e6PuiE.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\en2Jyn1qg7jEGhbzerb4PGCA.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\qzThW72RYcWSkAonVKQR5Zam.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\adc91a0e0132170ee1c9ace67d4b\Setup.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\w6vQnvc6GcufcSoPXxqtk9pf.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\XxaWUuSPH3Fo3U3cdFyCwDfN.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\qvQF1TKYhYFFgSpHGD6rgb7v.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\C88Sh505pu9bIEkUIPtIAuGY.exeJump to dropped file
                    Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2629.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\uusesdQ3Edo2k5kNA0mkf5gw.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\TDwHwUnikC3d4IvKdWZ8TN8E.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\adc91a0e0132170ee1c9ace67d4b\SetupUtility.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\u0apTRIaaBzfoydgvcDO3D8B.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\rdOeLIubzEtA5kaQGojFXfzi.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\l4NNL3d0gUhzOZ4YXgbQgdkt.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\SGRGSrOrLAvbIwSiEaRMIm3Y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\hypYBFCjte80ItmGLKdfXKZ2.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\SPpYvykupaNYuUQqOkv0xHw6.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\GlKtZqXQAiyhJM8NCtTVvYcF.exeJump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\DuDMa6rOf5SGixuVkls53BX0.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\dl0eBw1a4nselM03kEjNFUeZ.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\JNxHITgt9Gfgxa9zzN5RQgfc.exeJump to dropped file
                    Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BB52.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\uYMXNl5sSvaZoW3VwBNxI0U7.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\opugKRO9HQIQrHGr6X89OLro.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\dHxqqbbMHpGRP1KlVseWr6lF.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\gdGlSTAHRx5XYnptuFFvfF3Y.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\dHxqqbbMHpGRP1KlVseWr6lF.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\8jjMtFTS9Zlbf6vKPpWxHhte.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\dl0eBw1a4nselM03kEjNFUeZ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\MgZKvMc7DV5RedICsSIU2R0o.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Tc3J3MYPBvAb1zFAQ5lDv3bp.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\q1a6Hdte5ZphUujirBwwpHRY.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\yRbowIjZdxellWMLi8kEb6gJ.exeJump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s51[1]Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\C88Sh505pu9bIEkUIPtIAuGY.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\DigitalPulse\is-0SIDM.tmpJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\AboFkE91gGtC0jX22BS3GOn1.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\zDIXJhMuVzNtJxExlDXABWMh.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\cIYKpG6eQ8E5shW60pciCDk9.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\DuDMa6rOf5SGixuVkls53BX0.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5838081746.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\szKukjqbkrhlE2n6dTEMyu9d.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\wlmRug0KapvbPX1WnJ7a9tAS.exeJump to dropped file
                    Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2D42.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\P94EhV34EPtPaMGwUp1MdOBl.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\PEETw0QK3zD9r7HEE5AR45AO.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\qzThW72RYcWSkAonVKQR5Zam.exeJump to dropped file
                    Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\25C8.dllJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\uusesdQ3Edo2k5kNA0mkf5gw.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\UZMd9akv_Vfb8MG5RwDjTpGs.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\SVKcZYT3TwUPvLXOcZVQMjWE.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\adc91a0e0132170ee1c9ace67d4b\SetupUtility.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\Rh0zrbuPE23tmioMFpoeQvyq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\OdBy5UCgwCs2zOQ5hgwqYDDW.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exeJump to dropped file
                    Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9117.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\46ajs7POqByEYUKIKWz4ttVU.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseService.exe (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\Zm8A45fXl2ofLOUYJkU9Hc7y.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\ghXDF7wc1k0lMAVWTQE9mN9d.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\mGx41hPeYElMLjZ4bbI9SOQq.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\OoqQROwr1Yg6cLi95suPlaEZ.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\TDwHwUnikC3d4IvKdWZ8TN8E.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\KvSnRxw7nRoWWzdlM6L4ADmH.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\UZMd9akv_Vfb8MG5RwDjTpGs.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\XxaWUuSPH3Fo3U3cdFyCwDfN.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\GXEmL9Hio2yqAqGb8rDpNfoq.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\DigitalPulse\is-VGBL0.tmpJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\OoqQROwr1Yg6cLi95suPlaEZ.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\MAq6dYMqMOp7jsSy8ZTXM3iM.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\u0apTRIaaBzfoydgvcDO3D8B.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseUpdate.exe (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-N0LK6.tmp\_isetup\_setup64.tmpJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\3zaREjkJ8eT5V6QYRyuztw7a.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\t0EOMhSnTVCOCZS9qZwimCQw.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\cDbEZELclwHIblfubBb7q5VJ.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\KvSnRxw7nRoWWzdlM6L4ADmH.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\adc91a0e0132170ee1c9ace67d4b\Setup.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9315.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\WMMeMLRqjSsdlkGClauVg3Va.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\GXEmL9Hio2yqAqGb8rDpNfoq.exe.azhi (copy)Jump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\MAq6dYMqMOp7jsSy8ZTXM3iM.exe.azhi (copy)Jump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exeJump to dropped file
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeDropped PE file which has not been started: C:\Users\user\Pictures\1oYHJ3b1F3QrpZXBIXgl6loz.exeJump to dropped file
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0429D71C rdtsc 10_2_0429D71C
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,11_2_0040E670
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 600000
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599872
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599765
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599657
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599532
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599407
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599282
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599157
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 599029
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598922
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598797
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598672
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598547
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598421
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598313
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598204
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 598079
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597954
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597844
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597719
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597610
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597485
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597360
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597235
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 597110
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596985
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596860
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596735
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596604
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596485
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596360
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596233
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 596107
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595938
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595799
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595641
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595344
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 595110
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594856
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594672
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594485
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594296
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 594094
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593860
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 300000
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593610
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593344
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 593141
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592954
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592790
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592554
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592351
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 592132
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 591979
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 591523
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 591356
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 590934
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 590315
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 590127
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589929
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589789
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589622
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 589305
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588852
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588652
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588308
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 588027
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 587869
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 587415
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 587009
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 586228
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585949
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585661
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585458
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 585207
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 584962
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 584040
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 583228
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 583103
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582965
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582855
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582726
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582579
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582440
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582291
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582177
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 582054
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581935
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581815
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581685
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581551
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581421
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581300
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 581157
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580944
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580822
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580708
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580581
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580436
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580310
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 580141
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579885
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579668
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579355
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579215
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 579034
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578829
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578703
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578549
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578364
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 578160
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577932
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577761
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577584
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577322
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577182
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 577066
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576931
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576809
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576486
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576236
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 576103
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575944
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575827
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575695
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575567
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575432
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575308
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575186
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 575074
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574917
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574758
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574565
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574442
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 574293
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeThread delayed: delay time: 700000
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeThread delayed: delay time: 300000
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeAPI call chain: ExitProcess graph end nodegraph_11-40745
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.532122429.0000000002A4A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
                    Source: explorer.exe, 00000002.00000000.374261706.0000000000F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}:
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: aryvmcixn-SE-
                    Source: explorer.exe, 00000002.00000000.375180547.00000000087FC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                    Source: 4A15.exe, 0000000B.00000002.436099726.0000000002F30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
                    Source: explorer.exe, 00000002.00000000.375180547.00000000087FC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000s6x
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: &gt;&lt;'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: ameNewaPINGPOSTPathQEMUROOTH
                    Source: svchost.exe, 00000004.00000002.448034271.000001AC75CDF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.447981283.000001AC75C82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.448095688.000001AC75CEC000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000003.433599791.0000000000727000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435946180.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435946180.0000000000727000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.000000000143B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.678164342.00000000007CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8S}%SystemRoot%\system32\mswsock.dll}}
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: 11VBoxSFWINDIRWD
                    Source: 4A15.exe, 00000019.00000002.528784929.0000000000578000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: 4A15.exe, 0000000B.00000002.436099726.0000000002F30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                    Source: AddInProcess32.exe, 00000012.00000002.690591915.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.687702533.00000000018CF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: \\.\HGFS`
                    Source: 4A15.exe, 0000001D.00000003.584736156.000000000076E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
                    Source: explorer.exe, 00000002.00000000.375180547.0000000008857000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000 X
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: vmhgfsP
                    Source: i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: LNFuVMcI
                    Source: explorer.exe, 00000002.00000000.375180547.00000000087FC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000]
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s|%s%s|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: main.isRunningInsideVMWare
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
                    Source: explorer.exe, 00000002.00000000.375180547.00000000088B3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: #cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f563
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmpBinary or memory string: tVMSrvcs|!
                    Source: f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s*%d%s/%s%s:%d%s=%s&#34;&#39;&amp;+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:***@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
                    Source: 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpBinary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
                    Source: 4A15.exe, 0000001D.00000002.678164342.00000000007CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWD
                    Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_00410160
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_0040F730
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,11_2_0040FB98
                    Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior

                    Anti Debugging

                    barindex
                    Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
                    Source: C:\Users\user\Desktop\file.exeSystem information queried: CodeIntegrityInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwSystem information queried: CodeIntegrityInformationJump to behavior
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeSystem information queried: CodeIntegrityInformation
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,11_2_00412220
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0429C0A3 push dword ptr fs:[00000030h]10_2_0429C0A3
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_04470042 push dword ptr fs:[00000030h]10_2_04470042
                    Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeProcess queried: DebugPort
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00424168 _memset,IsDebuggerPresent,11_2_00424168
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,11_2_0042A57A
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004278D5 GetProcessHeap,11_2_004278D5
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_0429D71C rdtsc 10_2_0429D71C
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: page read and write | page guard
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_004329EC
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_004329BB SetUnhandledExceptionFilter,11_2_004329BB

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    System process connects to network (likely due to code injection or exploit)
                    Source: C:\Windows\explorer.exeNetwork Connect: 104.21.18.99 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 79.137.192.18 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 213.6.54.58 443Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 189.232.123.108 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 195.201.202.58 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 162.159.133.233 443Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 193.42.32.101 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 144.76.136.153 443Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 194.169.175.127 80Jump to behavior
                    Source: C:\Windows\explorer.exeNetwork Connect: 77.91.68.78 80Jump to behavior
                    Benign windows process drops PE files
                    Source: C:\Windows\explorer.exeFile created: jwjrtuw.2.drJump to dropped file
                    Maps a DLL or memory area into another process
                    Source: C:\Users\user\Desktop\file.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and readJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and readJump to behavior
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
                    Allocates memory in foreign processes
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeMemory written: C:\Users\user\AppData\Local\Temp\4A15.exe base: 400000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeMemory written: C:\Users\user\AppData\Local\Temp\4A15.exe base: 400000 value starts with: 4D5A
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeMemory written: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe base: 400000 value starts with: 4D5A
                    Contains functionality to inject code into remote processes
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_04470110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,10_2_04470110
                    Creates a thread in another existing process (thread injection)
                    Source: C:\Users\user\Desktop\file.exeThread created: C:\Windows\explorer.exe EIP: 4E91B14Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\jwjrtuwThread created: unknown EIP: 5981B14Jump to behavior
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeThread created: unknown EIP: 5C31930
                    Writes to foreign memory regions
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 404000
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 406000
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: AA3008
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe C:\Users\user\AppData\Local\Temp\4A15.exeJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Users\user\AppData\Local\Temp\A388.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe "C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe "C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe "C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe "C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe "C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe "C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe "C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe" /s
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe "C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe"
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: C:\Users\user\AppData\Local\Temp\4A15.exe "C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exeProcess created: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task
                    Source: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exeProcess created: C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe "C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeProcess created: unknown unknown
                    Source: C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exeProcess created: unknown unknown
                    Source: C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exeProcess created: unknown unknown
                    Source: C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exeProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpProcess created: unknown unknown
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,11_2_00419F90
                    Source: explorer.exe, 00000002.00000000.374737169.0000000005F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.374314416.0000000001530000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                    Source: explorer.exe, 00000002.00000000.374314416.0000000001530000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                    Source: explorer.exe, 00000002.00000000.374314416.0000000001530000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: mProgram Manager
                    Source: explorer.exe, 00000002.00000000.374261706.0000000000F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ProgmanDat
                    Source: explorer.exe, 00000002.00000000.374314416.0000000001530000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                    Source: explorer.exe, 00000002.00000000.375180547.0000000008857000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndEZS
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,10_2_044A3F87
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,10_2_0449C8B7
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,10_2_044A394D
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,10_2_044A49EA
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,10_2_044B0AB6
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,11_2_0043404A
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,11_2_00438178
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,11_2_00440116
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,11_2_004382A2
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: GetLocaleInfoW,_GetPrimaryLen,11_2_0043834F
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,11_2_00438423
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,11_2_004335E7
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: EnumSystemLocalesW,11_2_004387C8
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: GetLocaleInfoW,11_2_0043884E
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,11_2_00432B6D
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _TranslateName,_TranslateName,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,11_2_00437BB3
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: EnumSystemLocalesW,11_2_00437E27
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _GetPrimaryLen,EnumSystemLocalesW,11_2_00437E83
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _GetPrimaryLen,EnumSystemLocalesW,11_2_00437F00
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,11_2_0042BF17
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,11_2_00437F83
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,11_2_00432FAD
                    Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                    Source: C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                    Source: C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmpQueries volume information: C:\ VolumeInformation
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_044980F6 cpuid 10_2_044980F6
                    Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 10_2_00409507 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,10_2_00409507
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,11_2_0042FE47
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,11_2_00419F90
                    Source: C:\Users\user\AppData\Local\Temp\4A15.exeCode function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,11_2_00419F90

                    Stealing of Sensitive Information

                    barindex
                    Yara detected RedLine Stealer
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.27c2060.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.27c1058.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000021.00000003.469268991.00000000056E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468431350.0000000005643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469512589.00000000057D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470885243.0000000005859000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469454471.000000000564C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.483991106.00000000057FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.516044938.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.472304844.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470469816.000000000581B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507376862.0000000005644000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470206409.0000000005645000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.485627593.000000000564A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.482035496.000000000597E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496675989.00000000057BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496428031.00000000056DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.506833901.0000000005641000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.481731356.00000000057D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.510356408.0000000005642000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471354546.000000000576B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.467924288.0000000005041000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.505042457.000000000574D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.474548520.000000000591A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509183662.0000000005641000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473692356.0000000005641000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.476789219.0000000005648000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.497850220.0000000005649000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507439123.0000000005772000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471831991.0000000005644000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496379528.0000000005640000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507822905.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473229721.00000000058DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.494997611.000000000506D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496490328.0000000005643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.472464804.00000000058AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.467980289.000000000508B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468510767.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.494027534.0000000005041000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.506566555.0000000005858000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509036426.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.500072033.0000000005724000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470706005.000000000574C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468398950.0000000005145000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.505246801.0000000005646000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507273041.0000000005885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.482427984.000000000564C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.506178613.0000000005740000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.513208460.000000000564D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.493953689.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.481357469.0000000005640000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.467436264.00000000027BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473342046.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468889858.0000000005767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507966249.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473782346.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469115055.0000000005646000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469602619.0000000005712000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496104252.0000000005644000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469476494.000000000570E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496455854.0000000005781000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.522960258.0000000005BAF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473123019.0000000005789000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.511094027.0000000005BAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496888012.00000000057FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496634961.00000000056F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469550002.0000000005648000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470580270.000000000564E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509627314.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496838267.000000000571E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509729277.0000000005BA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496201408.00000000056DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509922852.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470309156.0000000005728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.472618978.0000000005642000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509816939.000000000564A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.504449157.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507153782.0000000005763000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496753788.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471595724.000000000588F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468158250.00000000050DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.479409950.000000000595A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471064264.000000000564D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.518524175.0000000005BAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.508451891.000000000579B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473582112.00000000057A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.510464244.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469421690.000000000579A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.522225873.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.477931726.00000000057CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469945364.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.486685012.000000000580D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.485093495.00000000059BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.502766048.0000000005801000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.521207744.0000000005649000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1], type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe, type: DROPPED
                    Yara detected SmokeLoader
                    Source: Yara matchFile source: 37.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 31.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.27d15a0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Yara detected Glupteba
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.4b20e67.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.4af0e67.13.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.541185132.0000000004F63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.522431758.0000000000843000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 941caPIfMmGnCq8PWe7WWHEk.exe PID: 7140, type: MEMORYSTR
                    Yara detected Clipboard Hijacker
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, type: DROPPED
                    Yara detected Fabookie
                    Source: Yara matchFile source: 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.497133342.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.487597561.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.529764912.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.557010087.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.540745976.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.529294566.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.624585849.0000000003A10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.565892568.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.587270076.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: i4PHS5R0iEKcuu4uBuaRKA3v.exe PID: 6864, type: MEMORYSTR
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\b7e4c0503c392ad23e181d12e1775bfc
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                    Source: C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

                    Remote Access Functionality

                    barindex
                    Yara detected RedLine Stealer
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.27c2060.6.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.50dd858.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.508b050.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.506d050.7.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.27c1058.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 33.3.U58dhzMU8ddvYuIUxUkOSiON.exe.5146010.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000021.00000003.469268991.00000000056E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468431350.0000000005643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469512589.00000000057D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470885243.0000000005859000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469454471.000000000564C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.483991106.00000000057FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.516044938.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.472304844.0000000005778000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470469816.000000000581B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507376862.0000000005644000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470206409.0000000005645000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.485627593.000000000564A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.482035496.000000000597E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496675989.00000000057BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496428031.00000000056DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.506833901.0000000005641000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.481731356.00000000057D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.510356408.0000000005642000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471354546.000000000576B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.467924288.0000000005041000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.505042457.000000000574D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.474548520.000000000591A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509183662.0000000005641000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473692356.0000000005641000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.476789219.0000000005648000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.497850220.0000000005649000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507439123.0000000005772000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471831991.0000000005644000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496379528.0000000005640000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507822905.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473229721.00000000058DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.494997611.000000000506D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496490328.0000000005643000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.472464804.00000000058AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.467980289.000000000508B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468510767.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.494027534.0000000005041000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.506566555.0000000005858000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509036426.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.500072033.0000000005724000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470706005.000000000574C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468398950.0000000005145000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.505246801.0000000005646000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507273041.0000000005885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.482427984.000000000564C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.506178613.0000000005740000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.513208460.000000000564D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.493953689.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.481357469.0000000005640000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.467436264.00000000027BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473342046.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468889858.0000000005767000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507966249.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473782346.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469115055.0000000005646000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469602619.0000000005712000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496104252.0000000005644000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469476494.000000000570E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496455854.0000000005781000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.522960258.0000000005BAF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473123019.0000000005789000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.511094027.0000000005BAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496888012.00000000057FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496634961.00000000056F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469550002.0000000005648000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470580270.000000000564E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509627314.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496838267.000000000571E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509729277.0000000005BA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496201408.00000000056DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509922852.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.470309156.0000000005728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.472618978.0000000005642000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.509816939.000000000564A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.504449157.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.507153782.0000000005763000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.496753788.0000000005647000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471595724.000000000588F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.468158250.00000000050DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.479409950.000000000595A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.471064264.000000000564D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.518524175.0000000005BAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.508451891.000000000579B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.473582112.00000000057A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.510464244.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469421690.000000000579A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.522225873.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.477931726.00000000057CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.469945364.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.486685012.000000000580D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.485093495.00000000059BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.502766048.0000000005801000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000021.00000003.521207744.0000000005649000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1], type: DROPPED
                    Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe, type: DROPPED
                    Yara detected SmokeLoader
                    Source: Yara matchFile source: 37.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 31.2.t3PINyJoW83t7JJSZ5BPE6bi.exe.27d15a0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Yara detected Glupteba
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.4b20e67.10.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.400000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 36.2.f8hJzDp1zQtAPJgciyNSoGpb.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 34.2.941caPIfMmGnCq8PWe7WWHEk.exe.4af0e67.13.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.541185132.0000000004F63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000024.00000002.522431758.0000000000843000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 941caPIfMmGnCq8PWe7WWHEk.exe PID: 7140, type: MEMORYSTR
                    Yara detected Fabookie
                    Source: Yara matchFile source: 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.497133342.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.487597561.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.529764912.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.557010087.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.540745976.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.529294566.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.624585849.0000000003A10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.565892568.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001A.00000003.587270076.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: i4PHS5R0iEKcuu4uBuaRKA3v.exe PID: 6864, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                    Valid Accounts11
                    Windows Management Instrumentation                    		1
                    DLL Side-Loading                    		1
                    Exploitation for Privilege Escalation                    		1
                    Disable or Modify Tools                    		1
                    OS Credential Dumping                    		2
                    System Time Discovery                    		Remote Services1
                    Archive Collected Data                    		Exfiltration Over Other Network Medium1
                    Ingress Tool Transfer                    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization2
                    Data Encrypted for Impact
                    Default Accounts1
                    Scripting                    		1
                    Windows Service                    		1
                    DLL Side-Loading                    		1
                    Deobfuscate/Decode Files or Information                    		1
                    Input Capture                    		1
                    Account Discovery                    		Remote Desktop Protocol1
                    Data from Local System                    		Exfiltration Over Bluetooth2
                    Encrypted Channel                    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                    Domain Accounts2
                    Native API                    		121
                    Registry Run Keys / Startup Folder                    		1
                    Windows Service                    		1
                    Scripting                    		Security Account Manager2
                    File and Directory Discovery                    		SMB/Windows Admin Shares1
                    Screen Capture                    		Automated Exfiltration1
                    Application Layer Protocol                    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                    Local Accounts1
                    Exploitation for Client Execution                    		1
                    Services File Permissions Weakness                    		712
                    Process Injection                    		3
                    Obfuscated Files or Information                    		NTDS36
                    System Information Discovery                    		Distributed Component Object Model1
                    Input Capture                    		Scheduled Transfer1
                    Proxy                    		SIM Card SwapCarrier Billing Fraud
                    Cloud Accounts3
                    Command and Scripting Interpreter                    		Network Logon Script121
                    Registry Run Keys / Startup Folder                    		33
                    Software Packing                    		LSA Secrets1
                    Query Registry                    		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                    Replication Through Removable MediaLaunchdRc.common1
                    Services File Permissions Weakness                    		1
                    Timestomp                    		Cached Domain Credentials561
                    Security Software Discovery                    		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                    External Remote ServicesScheduled TaskStartup ItemsStartup Items1
                    DLL Side-Loading                    		DCSync241
                    Virtualization/Sandbox Evasion                    		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                    File Deletion                    		Proc Filesystem3
                    Process Discovery                    		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                    Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)11
                    Masquerading                    		/etc/passwd and /etc/shadow1
                    Application Window Discovery                    		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                    Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)241
                    Virtualization/Sandbox Evasion                    		Network Sniffing3
                    System Owner/User Discovery                    		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                    Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron712
                    Process Injection                    		Input Capture1
                    Remote System Discovery                    		Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop
                    Compromise Software Supply ChainUnix ShellLaunchdLaunchd1
                    Hidden Files and Directories                    		Keylogging1
                    System Network Configuration Discovery                    		Component Object Model and Distributed COMScreen CaptureExfiltration over USBDNSInhibit System Recovery
                    Compromise Hardware Supply ChainVisual BasicScheduled TaskScheduled Task1
                    Regsvr32                    		GUI Input CaptureDomain GroupsExploitation of Remote ServicesEmail CollectionCommonly Used PortProxyDefacement
                    Trusted RelationshipPythonHypervisorProcess Injection1
                    Services File Permissions Weakness                    		Web Portal CaptureCloud GroupsAttack PC via USB ConnectionLocal Email CollectionStandard Application Layer ProtocolInternal ProxyInternal Defacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1313517 Sample: file.exe Startdate: 24/09/2023 Architecture: WINDOWS Score: 100 161 Multi AV Scanner detection for domain / URL 2->161 163 Found malware configuration 2->163 165 Malicious sample detected (through community Yara rule) 2->165 167 19 other signatures 2->167 10 file.exe 2->10         started        13 jwjrtuw 2->13         started        15 4A15.exe 2->15         started        17 2 other processes 2->17 process3 dnsIp4 199 Detected unpacking (changes PE section rights) 10->199 201 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->201 203 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->203 20 explorer.exe 65 58 10->20 injected 205 Maps a DLL or memory area into another process 13->205 207 Checks if the current machine is a virtual machine (disk enumeration) 13->207 209 Creates a thread in another existing process (thread injection) 13->209 211 Detected unpacking (overwrites its own PE header) 15->211 213 Injects a PE file into a foreign processes 15->213 25 4A15.exe 15->25         started        119 20.99.133.109 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 17->119 121 20.99.184.37 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 17->121 signatures5 process6 dnsIp7 131 79.137.192.18 PSKSET-ASRU Russian Federation 20->131 133 213.6.54.58 PALTEL-ASPALTELAutonomousSystemPS Palestinian Territory Occupied 20->133 135 7 other IPs or domains 20->135 111 C:\Users\user\AppData\Roaming\jwjrtuw, PE32 20->111 dropped 113 C:\Users\user\AppData\Local\Temp\D8E5.exe, PE32 20->113 dropped 115 C:\Users\user\AppData\Local\Temp\BB52.exe, PE32 20->115 dropped 117 9 other malicious files 20->117 dropped 183 System process connects to network (likely due to code injection or exploit) 20->183 185 Benign windows process drops PE files 20->185 187 Deletes itself after installation 20->187 189 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->189 27 A388.exe 20->27         started        30 4A15.exe 20->30         started        32 regsvr32.exe 20->32         started        file8 signatures9 process10 signatures11 215 Multi AV Scanner detection for dropped file 27->215 217 Writes to foreign memory regions 27->217 219 Allocates memory in foreign processes 27->219 221 Injects a PE file into a foreign processes 27->221 34 AddInProcess32.exe 27->34         started        38 AddInProcess32.exe 27->38         started        41 conhost.exe 27->41         started        43 AddInProcess32.exe 27->43         started        223 Detected unpacking (changes PE section rights) 30->223 225 Detected unpacking (overwrites its own PE header) 30->225 227 Writes a notice file (html or txt) to demand a ransom 30->227 229 2 other signatures 30->229 45 4A15.exe 1 15 30->45         started        47 regsvr32.exe 32->47         started        process12 dnsIp13 123 194.169.175.127 CLOUDCOMPUTINGDE Germany 34->123 125 85.217.144.143 WS171-ASRU Bulgaria 34->125 129 30 other IPs or domains 34->129 101 C:\Users\...\zB0tyM6N8N1lhBO2ZyVBkpB0.exe, PE32 34->101 dropped 103 C:\Users\...\xmJBaRtKA9fm4EreSTrCxLrH.exe, PE32 34->103 dropped 105 C:\Users\...\xWzXbvgqSclHLdENdr90zH0e.exe, PE32 34->105 dropped 109 257 other malicious files 34->109 dropped 49 Pwp3yspp3pM97CCYpnZxEaEs.exe 34->49         started        52 t3PINyJoW83t7JJSZ5BPE6bi.exe 34->52         started        55 941caPIfMmGnCq8PWe7WWHEk.exe 34->55         started        61 6 other processes 34->61 191 Drops script or batch files to the startup folder 38->191 193 Writes many files with high entropy 38->193 127 162.0.217.254 ACPCA Canada 45->127 107 C:\Users\user\AppData\Local\...\4A15.exe, PE32 45->107 dropped 195 Creates multiple autostart registry keys 45->195 57 4A15.exe 45->57         started        59 icacls.exe 45->59         started        197 Tries to detect sandboxes / dynamic malware analysis system (file name check) 47->197 file14 signatures15 process16 dnsIp17 91 C:\Users\...\Pwp3yspp3pM97CCYpnZxEaEs.tmp, PE32 49->91 dropped 64 Pwp3yspp3pM97CCYpnZxEaEs.tmp 49->64         started        169 Detected unpacking (changes PE section rights) 52->169 68 t3PINyJoW83t7JJSZ5BPE6bi.exe 52->68         started        171 Detected unpacking (overwrites its own PE header) 55->171 173 Found Tor onion address 55->173 175 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 55->175 177 Injects a PE file into a foreign processes 57->177 70 4A15.exe 57->70         started        141 154.221.26.108 HKKFGL-AS-APHKKwaifongGroupLimitedHK Seychelles 61->141 143 156.236.72.121 HKKFGL-AS-APHKKwaifongGroupLimitedHK Seychelles 61->143 145 3 other IPs or domains 61->145 93 C:\Users\...\YRhJ9y7wcq2JenN54ladams2.tmp, PE32 61->93 dropped 95 C:\Users\user\AppData\...\5838081746.exe, PE32 61->95 dropped 97 C:\Users\user\AppData\Local\...\s51[1], PE32 61->97 dropped 99 2 other malicious files 61->99 dropped 179 Detected unpacking (creates a PE file in dynamic memory) 61->179 181 Tries to harvest and steal browser information (history, passwords, etc) 61->181 73 YRhJ9y7wcq2JenN54ladams2.tmp 61->73         started        file18 signatures19 process20 dnsIp21 75 C:\Users\user\AppData\...\unins000.exe (copy), PE32 64->75 dropped 77 C:\Users\user\AppData\...\is-VGBL0.tmp, PE32+ 64->77 dropped 79 C:\Users\user\AppData\...\is-KJIQ4.tmp, PE32 64->79 dropped 87 4 other files (3 malicious) 64->87 dropped 147 Multi AV Scanner detection for dropped file 64->147 149 Creates multiple autostart registry keys 64->149 151 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 68->151 153 Maps a DLL or memory area into another process 68->153 155 Checks if the current machine is a virtual machine (disk enumeration) 68->155 157 Creates a thread in another existing process (thread injection) 68->157 137 189.232.123.108 UninetSAdeCVMX Mexico 70->137 139 181.197.76.240 CableOndaPA Panama 70->139 81 C:\Users\user\AppData\Local\...\build3[1].exe, PE32 70->81 dropped 83 C:\Users\user\AppData\Local\...\build2[1].exe, PE32 70->83 dropped 85 C:\Users\user\AppData\Local\...\build3.exe, PE32 70->85 dropped 89 142 other malicious files 70->89 dropped 159 Modifies existing user documents (likely ransomware behavior) 70->159 file22 signatures23

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    file.exe100%AviraHEUR/AGEN.1312455
                    file.exe100%Joe Sandbox ML

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exe100%AviraTR/Spy.Stealer.hpqrg
                    C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exe100%AviraTR/AD.Swrort.wizll
                    C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe100%AviraTR/Crypt.XPACK.Gen8
                    C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exe100%AviraHEUR/AGEN.1338858
                    C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exe100%AviraTR/Crypt.Agent.oqzji
                    C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exe100%AviraTR/AD.Swrort.wizll
                    C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exe100%AviraHEUR/AGEN.1312455
                    C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exe100%AviraHEUR/AGEN.1312455
                    C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exe100%AviraTR/AD.Swrort.wizll
                    C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exe100%AviraHEUR/AGEN.1338858
                    C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exe100%AviraHEUR/AGEN.1312455
                    C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exe100%AviraHEUR/AGEN.1312455
                    C:\Users\user\AppData\Local\G2DNcZFdbZ5vEmNAUVLs9Ohf.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\CluIFFuzrOPmXrVReYWFXWkl.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\DFhwCIhHEDQ5pEOtcRuwyHkl.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\45jOwggrSgiiBeW99lMmxS6j.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exe47%ReversingLabsWin32.Ransomware.GandCrab
                    C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exe71%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exe22%ReversingLabsWin32.Trojan.Babar
                    C:\Users\user\AppData\Local\3DW8qUWA963x8XKarJJ0WTU1.exe4%ReversingLabs
                    C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exe71%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\3e7TFXuOpvanKkAtgXUBsjg5.exe48%ReversingLabsWin32.Trojan.ProxyNation
                    C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exe96%ReversingLabsWin32.Trojan.SmokeLoader
                    C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe82%ReversingLabsWin32.Trojan.ClipBanker
                    C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exe47%ReversingLabsWin32.Ransomware.GandCrab
                    C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exe71%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\90MmY3vsUc9ABzZegEZBdNOJ.exe48%ReversingLabsWin32.Trojan.ProxyNation
                    C:\Users\user\AppData\Local\9rjyJ5VsLUcAN5cWEKCTLeAn.exe4%ReversingLabs
                    C:\Users\user\AppData\Local\AboFkE91gGtC0jX22BS3GOn1.exe35%ReversingLabsWin64.Trojan.InjectorX
                    C:\Users\user\AppData\Local\BYpvSgsqBQF2e9VWX5DwhO9b.exe48%ReversingLabsWin32.Trojan.ProxyNation
                    C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exe22%ReversingLabsWin32.Trojan.Babar
                    C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exe70%ReversingLabsWin32.Trojan.Zusy
                    C:\Users\user\AppData\Local\HZmkan0RtnpmEbbLPyds7uQ6.exe48%ReversingLabsWin32.Trojan.ProxyNation
                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]17%ReversingLabsWin32.Trojan.RedLine
                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build2[1].exe96%ReversingLabsWin32.Trojan.SmokeLoader
                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe82%ReversingLabsWin32.Trojan.ClipBanker
                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s51[1]17%ReversingLabsWin32.Trojan.RedLine
                    C:\Users\user\AppData\Local\Mrqt0LPomy7YxUAwjV5w1C4Z.exe47%ReversingLabsWin32.Ransomware.GandCrab
                    C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exe47%ReversingLabsWin32.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\OdBy5UCgwCs2zOQ5hgwqYDDW.exe78%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\PEETw0QK3zD9r7HEE5AR45AO.exe35%ReversingLabsWin64.Trojan.InjectorX
                    C:\Users\user\AppData\Local\QmwuUY15y0L4DcEZ4ogFMHTp.exe22%ReversingLabsWin32.Trojan.Babar
                    C:\Users\user\AppData\Local\SXfcayqkk1DZ7GAEIik6FBEC.exe22%ReversingLabsWin32.Trojan.Babar
                    C:\Users\user\AppData\Local\TNzDEBB9FdUrEB9ZmBfj0vTU.exe47%ReversingLabsWin32.Ransomware.GandCrab
                    C:\Users\user\AppData\Local\TUpbZ8vU8BuCVac1Gcxet4HJ.exe70%ReversingLabsWin32.Trojan.Zusy
                    C:\Users\user\AppData\Local\Tc3J3MYPBvAb1zFAQ5lDv3bp.exe78%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\Temp\2629.exe53%ReversingLabsWin32.Ransomware.MintZard
                    C:\Users\user\AppData\Local\Temp\4A15.exe56%ReversingLabsWin32.Ransomware.MintZard
                    C:\Users\user\AppData\Local\Temp\5838081746.exe17%ReversingLabsWin32.Trojan.RedLine
                    C:\Users\user\AppData\Local\Temp\A388.exe70%ReversingLabsWin32.Trojan.Generic
                    C:\Users\user\AppData\Local\Temp\BB52.exe78%ReversingLabsByteCode-MSIL.Trojan.Smokeloader
                    C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp30%ReversingLabsWin32.Trojan.Generic
                    C:\Users\user\AppData\Local\Temp\is-N0LK6.tmp\_isetup\_setup64.tmp0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp6%ReversingLabs
                    C:\Users\user\AppData\Local\TtG5py94KsXzXSkP3RqVlzUB.exe48%ReversingLabsWin32.Trojan.ProxyNation
                    C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exe47%ReversingLabsWin32.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\WQ1sXS4A8SPQ3OH5qUwmsfK7.exe78%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\X4G1qMGsevrGDCsTxtK3q3TA.exe70%ReversingLabsWin32.Trojan.Zusy
                    C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exe47%ReversingLabsWin32.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\c8KXUlVEBLWKm0FvrBR7FzOQ.exe71%ReversingLabsWin64.Trojan.Lgoogloader
                    C:\Users\user\AppData\Local\cIYKpG6eQ8E5shW60pciCDk9.exe35%ReversingLabsWin64.Trojan.InjectorX

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov0%URL Reputationsafe
                    http://app.nnnaajjjgc.com/100%URL Reputationmalware
                    https://java.sun.com0%URL Reputationsafe
                    http://ocsp.sectigo.com00%URL Reputationsafe
                    http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro0%URL Reputationsafe
                    http://app.nnnaajjjgc.com/check/safe100%URL Reputationmalware
                    https://www.amsangroup.com/wp-includes/net/gate4.exe0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1134664&key=5a5e7537a8885a65fb2b4176d4c48e2c100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9bec507f97304d55a100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d6100%Avira URL Cloudmalware
                    http://colisumy.com/dl/build2.exe$run18%VirustotalBrowse
                    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%VirustotalBrowse
                    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%Avira URL Cloudsafe
                    http://colisumy.com/dl/build2.exe$run100%Avira URL Cloudmalware
                    https://pastebin.comG0%Avira URL Cloudsafe
                    https://justsafepay.com/03ea740ea772f2ff2218e4ed0bfbac4b/7a54bdb20779c4359694feaa1398dd25.exe0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372y100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55aad23e1100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55a100%Avira URL Cloudmalware
                    http://novanosa5org.org/100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/safebt100%Avira URL Cloudmalware
                    http://novanosa5org.org/19%VirustotalBrowse
                    http://app.nnnaajjjgc.com/check/?sid=1135418&key=af1ae34227e74b84877a2b0bbf3bee9bmi100%Avira URL Cloudmalware
                    https://www.remobjects.com/ps0%Avira URL Cloudsafe
                    https://www.innosetup.com/0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d61:ut100%Avira URL Cloudmalware
                    https://zaoshanghao.suhttps://zaoshanghao.suRegQueryValueExWUUIDPGDSE0%Avira URL Cloudsafe
                    https://www.innosetup.com/2%VirustotalBrowse
                    http://app.nnnaajjjgc.com/check/?sid=1134790&key=72224396aab18bba753981c520d8b1a5Gh100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com:80/check/safe100%Avira URL Cloudmalware
                    http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionS-1-5-21-3853321935-2125563209-0%Avira URL Cloudsafe
                    https://www.remobjects.com/ps0%VirustotalBrowse
                    http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55a#100%Avira URL Cloudmalware
                    http://www.innosetup.com/0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com:80/check/safe20%VirustotalBrowse
                    http://5.42.64.10/api/files/software/s5.exe100%Avira URL Cloudmalware
                    http://script.google.cpp.nnnaajjjgc.com/check/safe100%Avira URL Cloudmalware
                    http://www.innosetup.com/2%VirustotalBrowse
                    http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9b6C92100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d66C92100%Avira URL Cloudmalware
                    http://link.storjshare.io/jw6d5ycuf7e6mtiudwapyqs22o2q/less-bucket%2F3la%20barra%2FLightCleaner.exe?0%Avira URL Cloudsafe
                    http://crl.ver)0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bd100%Avira URL Cloudmalware
                    http://5.42.64.10/api/files/software/s5.exe13%VirustotalBrowse
                    http://link.storjshare.io/jw6d5ycuf7e6mtiudwapyqs22o2q/less-bucket%2F3la%20barra%2FLightCleaner.exe?0%VirustotalBrowse
                    http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WAR0%Avira URL Cloudsafe
                    http://https://_bad_pdb_file.pdb0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c06C92100%Avira URL Cloudmalware
                    https://stats.vk-portal.net0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c0100%Avira URL Cloudmalware
                    https://downloads.digitalpulsedata.com/0.16.16/DigitalPulse.exe100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/safe7OM100%Avira URL Cloudmalware
                    https://blockchain.infoindex0%Avira URL Cloudsafe
                    https://potatogoose.com/03ea740ea772f2ff2218e4ed0bfbac4b/baf14778c246e15550645e30ba78ce1c.exe100%Avira URL Cloudmalware
                    https://downloads.digitalpulsedata.com/0.16.16/DigitalPulse.exe14%VirustotalBrowse
                    https://digitalpulsedata.com/pp/100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135324&key=7d66a132c21ba63fc78546c9d24589f2100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb98f379fab8100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b5100%Avira URL Cloudmalware
                    http://ji.alie3ksgbb.com/m/ss29100%Avira URL Cloudmalware
                    https://digitalpulsedata.com/pp/8%VirustotalBrowse
                    http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372100%Avira URL Cloudmalware
                    https://we.tl/t-e5pgPH03c0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1134752&key=b91eaeee1ec96f7344a52c72e78649e0w100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdkO100%Avira URL Cloudmalware
                    https://www.amsangroup.com0%Avira URL Cloudsafe
                    http://soryytlic4.net/100%Avira URL Cloudmalware
                    http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#0%Avira URL Cloudsafe
                    http://zexeq.com/files/1/build3.exe$run100%Avira URL Cloudmalware
                    https://desktop-netinspp.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bd100%Avira URL Cloudmalware
                    https://m7val1dat0r.info0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb9100%Avira URL Cloudmalware
                    http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error0%Avira URL Cloudsafe
                    http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b30100%Avira URL Cloudmalware
                    http://zexeq.com/filespp.nnnaajjjgc.com/100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01G100%Avira URL Cloudmalware
                    https://potatogoose.com100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134630&key=a7f738ef34a58abfd14b211f7ae4d75a;100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/0vx100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1081221o100%Avira URL Cloudmalware
                    http://zexeq.com/files/1/build3.exerun100%Avira URL Cloudmalware
                    http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01;100%Avira URL Cloudmalware

                    Domains and IPs

                    Contacted Domains

                    ⊘No contacted domains info

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://novanosa5org.org/true
                    • 19%, Virustotal, Browse
                    • Avira URL Cloud: malware
                    		unknown
                    http://soryytlic4.net/true
                    • Avira URL Cloud: malware
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://www.amsangroup.com/wp-includes/net/gate4.exeAddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://app.nnnaajjjgc.com/check/?sid=1134664&key=5a5e7537a8885a65fb2b4176d4c48e2ci4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.478481171.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.477596745.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmptrue
                    • Avira URL Cloud: malware
                    		unknown
                    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpfalse
                    • 0%, Virustotal, Browse
                    • Avira URL Cloud: safe
                    		unknown
                    http://hbn42414.beget.techAddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9bec507f97304d55ai4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A1E000.00000004.00000020.00020000.00000000.sdmptrue
                      • Avira URL Cloud: malware
                      		unknown
                      http://colisumy.com/dl/build2.exe$run4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpfalse
                      • 18%, Virustotal, Browse
                      • Avira URL Cloud: malware
                      		unknown
                      https://papi.vk.com/pushsse/ruim4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d6i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: malware
                        		unknown
                        https://api.ipify.org/iphttps://api.my-ip.ioU58dhzMU8ddvYuIUxUkOSiON.exe, 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://justsafepay.com/03ea740ea772f2ff2218e4ed0bfbac4b/7a54bdb20779c4359694feaa1398dd25.exeAddInProcess32.exe, 00000012.00000002.709315982.0000000002D93000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://pastebin.comGAddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372yi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504972513.00000000039E1000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487859289.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.504033756.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508038273.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487163158.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487415421.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55aad23e1i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A2D000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          https://vk.com4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55ai4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.507939167.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            http://app.nnnaajjjgc.com/check/safebti4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.571334117.00000000039C9000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            http://app.nnnaajjjgc.com/check/?sid=1135418&key=af1ae34227e74b84877a2b0bbf3bee9bmii4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.580765017.0000000003A2B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.568847528.0000000003A2C000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            https://www.remobjects.com/psPwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000024F0000.00000004.00001000.00020000.00000000.sdmpfalse
                            • 0%, Virustotal, Browse
                            • Avira URL Cloud: safe
                            		unknown
                            https://www.innosetup.com/Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000024F0000.00000004.00001000.00020000.00000000.sdmpfalse
                            • 2%, Virustotal, Browse
                            • Avira URL Cloud: safe
                            		unknown
                            http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d61:uti4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            https://zaoshanghao.suhttps://zaoshanghao.suRegQueryValueExWUUIDPGDSE941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DC88000.00000004.00001000.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://app.nnnaajjjgc.com/check/?sid=1134790&key=72224396aab18bba753981c520d8b1a5Ghi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A1E000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.588792935.0000000003A2B000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A24000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            https://turnitin.com/robot/crawlerinfo.html)cannot941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpfalse
                              		high
                              http://app.nnnaajjjgc.com:80/check/safei4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014B2000.00000004.00000020.00020000.00000000.sdmpfalse
                              • 20%, Virustotal, Browse
                              • Avira URL Cloud: malware
                              		unknown
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameAddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, 4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.00000000035F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.reddit.com/4A15.exe, 00000019.00000003.516279370.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionS-1-5-21-3853321935-2125563209-941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.557680058.000000000DCD4000.00000004.00001000.00020000.00000000.sdmptrue
                                  • Avira URL Cloud: safe
                                  		low
                                  http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360V1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445817611.0000000000487000.00000008.00000001.01000000.00000018.sdmpfalse
                                    		high
                                    http://app.nnnaajjjgc.com/check/?sid=1134916&key=3167af0b34b5a44fdec507f97304d55a#i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508038273.00000000039E6000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510336455.00000000039E5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://www.innosetup.com/YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.442316567.0000000002440000.00000004.00001000.00020000.00000000.sdmp, YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.443753613.0000000002330000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • 2%, Virustotal, Browse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://5.42.64.10/api/files/software/s5.exeAddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • 13%, Virustotal, Browse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://script.google.cpp.nnnaajjjgc.com/check/safei4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.640934427.0000000003A3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://app.nnnaajjjgc.com/check/?sid=1134940&key=9c360413b20472b92e1b278c2654cd9b6C92i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510056403.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://app.nnnaajjjgc.com/check/?sid=1135340&key=86810d751c0aa0fa28346472918311d66C92i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://link.storjshare.io/jw6d5ycuf7e6mtiudwapyqs22o2q/less-bucket%2F3la%20barra%2FLightCleaner.exe?YRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000003.526186837.0000000002051000.00000004.00001000.00020000.00000000.sdmpfalse
                                    • 0%, Virustotal, Browse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groovexplorer.exe, 00000002.00000000.376345728.00007FFC2B229000.00000002.00000001.01000000.00000005.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineYRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000002.526416925.0000000000401000.00000020.00000001.01000000.00000015.sdmpfalse
                                      		high
                                      http://crl.ver)svchost.exe, 00000004.00000002.448095688.000001AC75CEC000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		low
                                      http://app.nnnaajjjgc.com/i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659928263.0000000003840000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.508069337.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659906409.00000000036C0000.00000040.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.510371610.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.621914047.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659798164.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.624585849.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmptrue
                                      • URL Reputation: malware
                                      		unknown
                                      http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A16000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A22000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: malware
                                      		unknown
                                      https://api.2ip.ua/geo.jsoni4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WARV1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		low
                                        http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c06C92i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.640934427.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: malware
                                        		unknown
                                        http://down.360safe.com/setup.exePathSOFTWAREV1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000002.445804410.0000000000471000.00000002.00000001.01000000.00000018.sdmpfalse
                                          		high
                                          http://https://_bad_pdb_file.pdb941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.00000000051BB000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000ACC000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.541185132.00000000051EB000.00000040.00001000.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low
                                          https://stats.vk-portal.net4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://app.nnnaajjjgc.com/check/?sid=1136118&key=18166b66b4c087f47773dacf194063c0i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.641242547.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.639907595.00000000039C4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.640934427.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          https://downloads.digitalpulsedata.com/0.16.16/DigitalPulse.exeAddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • 14%, Virustotal, Browse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54bi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://app.nnnaajjjgc.com/check/safe7OMi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.646375492.00000000039C2000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.639907595.00000000039C4000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.google.com/feedfetcher.html)HKLM941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, 941caPIfMmGnCq8PWe7WWHEk.exe, 00000022.00000002.525875413.0000000000400000.00000040.00000001.01000000.00000017.sdmp, f8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpfalse
                                            		high
                                            https://api.2ip.ua/geo.json74A15.exe, 0000001D.00000002.678164342.000000000078C000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://java.sun.comexplorer.exe, 00000002.00000000.374746176.00000000068D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.374517074.0000000004AFA000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://blockchain.infoindexf8hJzDp1zQtAPJgciyNSoGpb.exe, 00000024.00000002.522431758.0000000000400000.00000040.00000001.01000000.00000019.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://potatogoose.com/03ea740ea772f2ff2218e4ed0bfbac4b/baf14778c246e15550645e30ba78ce1c.exeAddInProcess32.exe, 00000012.00000002.709315982.0000000002D97000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: malware
                                              		unknown
                                              https://telegram.org/pp.nnnaajjjgc.com/i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.582090716.00000000039DA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://digitalpulsedata.com/pp/Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.439723896.00000000024F0000.00000004.00001000.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000002.677592753.0000000002287000.00000004.00001000.00020000.00000000.sdmpfalse
                                                • 8%, Virustotal, Browse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://app.nnnaajjjgc.com/check/?sid=1135324&key=7d66a132c21ba63fc78546c9d24589f2i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb98f379fab8i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A25000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522164708.0000000003A2D000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.518699245.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b5i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                http://ji.alie3ksgbb.com/m/ss29AddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: malware
                                                		unknown
                                                https://api.2ip.ua/geo.jsonB4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://app.nnnaajjjgc.com/check/?sid=1134718&key=abd6c79d9cdea0adf3c5fbb50faa6372i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487859289.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.484324155.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.482007401.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487163158.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.483619386.00000000039D8000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487415421.00000000039DA000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.481490961.00000000039D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  https://we.tl/t-e5pgPH03c4A15.exe, 00000019.00000002.528888660.0000000000629000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528105248.0000000000629000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://app.nnnaajjjgc.com/check/?sid=1134752&key=b91eaeee1ec96f7344a52c72e78649e0wi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.487382669.0000000003A33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  http://ocsp.sectigo.com0AddInProcess32.exe, 00000012.00000002.709315982.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DA7000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://app.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdkOi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.groexplorer.exe, 00000002.00000000.376345728.00007FFC2B229000.00000002.00000001.01000000.00000005.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUYRhJ9y7wcq2JenN54ladams2.exe, 00000020.00000002.526416925.0000000000401000.00000020.00000001.01000000.00000015.sdmpfalse
                                                    		high
                                                    https://www.amsangroup.comAddInProcess32.exe, 00000012.00000002.709315982.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000012.00000002.709315982.0000000002D9B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.amazon.com/4A15.exe, 00000019.00000003.516080817.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#AddInProcess32.exe, 00000012.00000002.709315982.0000000002DB0000.00000004.00000800.00020000.00000000.sdmp, Pwp3yspp3pM97CCYpnZxEaEs.exe, 0000001C.00000003.440105042.00000000025E8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      http://zexeq.com/files/1/build3.exe$run4A15.exe, 00000019.00000002.528784929.00000000005FF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: malware
                                                      		unknown
                                                      http://www.twitter.com/4A15.exe, 00000019.00000003.516314996.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://desktop-netinspp.nnnaajjjgc.com/check/?sid=1136320&key=f4073b8c48cdf506608aafebc7c710bdi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        https://m7val1dat0r.info4GAUQKCdkFpttJoyS2YGgxr9.exe, 0000001E.00000002.699952372.00000000035F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://app.nnnaajjjgc.com/check/?sid=1134966&key=0fd5f12a596a555ef492fb9i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.521926205.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.522984526.00000000039D4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        http://www.openssl.org/support/faq.html4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error4A15.exe, 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 4A15.exe, 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		low
                                                          http://app.nnnaajjjgc.com/check/?sid=1135184&key=e2b003b01e4d0eb6ffeb7affbde6d54b30i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.541322508.00000000039E4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.550000806.00000000039C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          http://zexeq.com/filespp.nnnaajjjgc.com/i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          https://api.2ip.ua/geo.jsonz4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://st6-20.vk.com/css/al/base.2e3fc345b3e9701dafc5.css4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://app.nnnaajjjgc.com/check/i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.644710934.0000000003A19000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.650934958.0000000003A1E000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659975363.0000000003A22000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: malware
                                                              		unknown
                                                              http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01Gi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.493610182.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.503664579.0000000003A33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: malware
                                                              		unknown
                                                              https://potatogoose.comAddInProcess32.exe, 00000012.00000002.709315982.0000000002DC0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              • Avira URL Cloud: malware
                                                              		unknown
                                                              http://app.nnnaajjjgc.com/check/safei4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.559968655.00000000039CF000.00000004.00000020.00020000.00000000.sdmptrue
                                                              • URL Reputation: malware
                                                              		unknown
                                                              https://api.2ip.ua/geo.jsonp4A15.exe, 00000019.00000002.528784929.0000000000578000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://api.2ip.ua/geo.jsonr4A15.exe, 0000001D.00000003.584736156.000000000076E000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 0000001D.00000002.678164342.0000000000748000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.360safe.com/totalsecurity/en/101/tswin10u/d7http://www.360safe.com/totalsecurity/en/101/tV1NdDWPeq5yoU55PUCrHuT1N.exe, 00000023.00000000.444126937.000000000056E000.00000002.00000001.01000000.00000018.sdmpfalse
                                                                    		high
                                                                    http://app.nnnaajjjgc.com/check/?sid=1134630&key=a7f738ef34a58abfd14b211f7ae4d75a;i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.478481171.00000000039E5000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.477596745.00000000039C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    http://app.nnnaajjjgc.com/0vxi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000002.659717297.00000000014BC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    http://app.nnnaajjjgc.com/check/?sid=1135652&key=52a1fa091a2d98cce516cbabc104bbb1081221oi4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.587270076.0000000003A32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    http://zexeq.com/files/1/build3.exerun4A15.exe, 00000019.00000003.526920988.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.528078249.00000000030B1000.00000004.00000020.00020000.00000000.sdmp, 4A15.exe, 00000019.00000002.529745378.00000000030B1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    http://app.nnnaajjjgc.com/check/?sid=1134810&key=2e80054952ba0f1faf1a5db7f7ffcc01;i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.494963976.00000000039D4000.00000004.00000020.00020000.00000000.sdmp, i4PHS5R0iEKcuu4uBuaRKA3v.exe, 0000001A.00000003.500068426.00000000039E5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    https://dev.vk.com4A15.exe, 00000019.00000003.523963155.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.526468027.0000000003170000.00000004.00001000.00020000.00000000.sdmp, 4A15.exe, 00000019.00000003.523571046.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.nytimes.com/4A15.exe, 00000019.00000003.516248171.0000000003170000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high

                                                                        World Map of Contacted IPs

                                                                        • No. of IPs < 25%
                                                                        • 25% < No. of IPs < 50%
                                                                        • 50% < No. of IPs < 75%
                                                                        • 75% < No. of IPs

                                                                        Public IPs

                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                        87.236.19.5
                                                                        		unknownRussian Federation
                                                                        		198610BEGET-ASRUfalse
                                                                        65.8.243.45
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        195.201.202.58
                                                                        		unknownGermany
                                                                        		24940HETZNER-ASDEtrue
                                                                        8.8.8.8
                                                                        		unknownUnited States
                                                                        		15169GOOGLEUSfalse
                                                                        144.76.136.153
                                                                        		unknownGermany
                                                                        		24940HETZNER-ASDEtrue
                                                                        162.0.217.254
                                                                        		unknownCanada
                                                                        		35893ACPCAfalse
                                                                        65.8.243.52
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        172.67.180.173
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        65.8.243.108
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        172.67.202.56
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        172.67.187.122
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        143.204.29.6
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        142.250.188.14
                                                                        		unknownUnited States
                                                                        		15169GOOGLEUSfalse
                                                                        143.204.29.2
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        20.99.184.37
                                                                        		unknownUnited States
                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                        172.67.34.170
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        162.159.133.233
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUStrue
                                                                        143.204.29.20
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        193.42.32.101
                                                                        		unknownGermany
                                                                        		3221EENET-ASEEtrue
                                                                        185.244.226.4
                                                                        		unknownunknown
                                                                        		197540NETCUP-ASnetcupGmbHDEfalse
                                                                        194.169.175.127
                                                                        		unknownGermany
                                                                        		43659CLOUDCOMPUTINGDEtrue
                                                                        20.99.133.109
                                                                        		unknownUnited States
                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                        148.251.234.93
                                                                        		unknownGermany
                                                                        		24940HETZNER-ASDEfalse
                                                                        107.167.110.216
                                                                        		unknownUnited States
                                                                        		21837OPERASOFTWAREUSfalse
                                                                        104.21.35.235
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        104.21.32.208
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        107.167.110.211
                                                                        		unknownUnited States
                                                                        		21837OPERASOFTWAREUSfalse
                                                                        172.67.199.174
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        5.42.64.10
                                                                        		unknownRussian Federation
                                                                        		39493RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRUfalse
                                                                        104.21.18.99
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUStrue
                                                                        79.137.192.18
                                                                        		unknownRussian Federation
                                                                        		42569PSKSET-ASRUtrue
                                                                        172.67.222.167
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        104.21.90.117
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        172.67.200.102
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        142.250.189.225
                                                                        		unknownUnited States
                                                                        		15169GOOGLEUSfalse
                                                                        181.197.76.240
                                                                        		unknownPanama
                                                                        		18809CableOndaPAfalse
                                                                        190.8.176.96
                                                                        		unknownColombia
                                                                        		52335ColombiaHostingCOfalse
                                                                        143.204.29.13
                                                                        		unknownUnited States
                                                                        		16509AMAZON-02USfalse
                                                                        154.221.26.108
                                                                        		unknownSeychelles
                                                                        		133115HKKFGL-AS-APHKKwaifongGroupLimitedHKfalse
                                                                        156.236.72.121
                                                                        		unknownSeychelles
                                                                        		133115HKKFGL-AS-APHKKwaifongGroupLimitedHKfalse
                                                                        104.21.14.50
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        85.217.144.143
                                                                        		unknownBulgaria
                                                                        		41995WS171-ASRUfalse
                                                                        168.119.1.241
                                                                        		unknownGermany
                                                                        		24940HETZNER-ASDEfalse
                                                                        213.6.54.58
                                                                        		unknownPalestinian Territory Occupied
                                                                        		12975PALTEL-ASPALTELAutonomousSystemPStrue
                                                                        189.232.123.108
                                                                        		unknownMexico
                                                                        		8151UninetSAdeCVMXtrue
                                                                        104.21.21.180
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        172.67.216.81
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        77.91.68.78
                                                                        		unknownRussian Federation
                                                                        		42861FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRUtrue
                                                                        104.20.67.143
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse
                                                                        104.21.93.225
                                                                        		unknownUnited States
                                                                        		13335CLOUDFLARENETUSfalse

                                                                        Private

                                                                        IP
                                                                        192.168.2.1

                                                                        General Information

                                                                        Joe Sandbox Version:38.0.0 Beryl
                                                                        Analysis ID:1313517
                                                                        Start date and time:2023-09-24 14:03:04 +02:00
                                                                        Joe Sandbox Product:CloudBasic
                                                                        Overall analysis duration:0h 13m 54s
                                                                        Hypervisor based Inspection enabled:false
                                                                        Report type:full
                                                                        Cookbook file name:default.jbs
                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                        Number of analysed new started processes analysed:66
                                                                        Number of new started drivers analysed:0
                                                                        Number of existing processes analysed:0
                                                                        Number of existing drivers analysed:0
                                                                        Number of injected processes analysed:2
                                                                        Technologies:
                                                                        • HCA enabled
                                                                        • EGA enabled
                                                                        • HDC enabled
                                                                        • AMSI enabled
                                                                        Analysis Mode:default
                                                                        Analysis stop reason:Timeout
                                                                        Sample file name:file.exe
                                                                        Detection:MAL
                                                                        Classification:mal100.rans.troj.spyw.expl.evad.winEXE@149/755@0/51
                                                                        EGA Information:
                                                                        • Successful, ratio: 100%
                                                                        HDC Information:Failed
                                                                        HCA Information:
                                                                        • Successful, ratio: 89%
                                                                        • Number of executed functions: 46
                                                                        • Number of non-executed functions: 112
                                                                        Cookbook Comments:
                                                                        • Found application associated with file extension: .exe

                                                                        Warnings

                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, consent.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                        • Report size getting too big, too many NtWriteFile calls found.
                                                                        • Skipping network analysis since amount of network traffic is too extensive

                                                                        Simulations

                                                                        Behavior and APIs

                                                                        TimeTypeDescription
                                                                        05:04:20Task SchedulerRun new task: Firefox Default Browser Agent 9AA5E0263B54956D path: C:\Users\user\AppData\Roaming\jwjrtuw
                                                                        05:04:31Task SchedulerRun new task: Time Trigger Task path: C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe s>--Task
                                                                        05:04:32AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe" --AutoStart
                                                                        05:04:43AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe" --AutoStart
                                                                        05:04:50Task SchedulerRun new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                        05:04:53Task SchedulerRun new task: DigitalPulseUpdateTask path: C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseUpdate.exe
                                                                        05:05:10AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run DigitalPulse "C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseService.exe" 5333:::clickId=:::srcId=
                                                                        05:05:20AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Lfhv80yjQqPZSzTm3yFdWPF.bat
                                                                        05:05:36AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\745tzE4k357KTJX9XrGihSFX.bat
                                                                        05:05:51AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7LUSH97ozicm8oSAzFzv30fB.bat
                                                                        05:06:04Task SchedulerRun new task: GoogleUpdateTaskMachineQC path: %ProgramFiles%\Google\Chrome\updater.exe
                                                                        05:06:11Task SchedulerRun new task: Opera scheduled Autoupdate 1695557137 path: C:\Users\user\AppData\Local\Programs\Opera\launcher.exe s>--scheduledautoupdate $(Arg0)
                                                                        05:06:31AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aflaw6AZSGKIe0s45Bz4rgPm.bat
                                                                        05:06:51Task SchedulerRun new task: PowerControl HR path: C:\Program s>Files (x86)\PowerControl\PowerControl_Svc.exe
                                                                        05:06:54Task SchedulerRun new task: PowerControl LG path: C:\Program s>Files (x86)\PowerControl\PowerControl_Svc.exe
                                                                        14:04:17API Interceptor7202x Sleep call for process: explorer.exe modified
                                                                        14:04:22API Interceptor7x Sleep call for process: svchost.exe modified
                                                                        14:04:29API Interceptor507x Sleep call for process: AddInProcess32.exe modified
                                                                        14:04:34API Interceptor3x Sleep call for process: U58dhzMU8ddvYuIUxUkOSiON.exe modified
                                                                        14:04:35API Interceptor397x Sleep call for process: 4GAUQKCdkFpttJoyS2YGgxr9.exe modified
                                                                        14:04:41API Interceptor3x Sleep call for process: 941caPIfMmGnCq8PWe7WWHEk.exe modified
                                                                        14:04:43API Interceptor1x Sleep call for process: 4A15.exe modified
                                                                        14:04:44API Interceptor13x Sleep call for process: i4PHS5R0iEKcuu4uBuaRKA3v.exe modified
                                                                        14:04:44API Interceptor3x Sleep call for process: f8hJzDp1zQtAPJgciyNSoGpb.exe modified

                                                                        Joe Sandbox View / Context

                                                                        IPs

                                                                        ⊘No context

                                                                        Domains

                                                                        ⊘No context

                                                                        ASNs

                                                                        ⊘No context

                                                                        JA3 Fingerprints

                                                                        ⊘No context

                                                                        Dropped Files

                                                                        ⊘No context

                                                                        Created / dropped Files

                                                                        C:\SystemID\PersonalID.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):42
                                                                        Entropy (8bit):4.802915339393917
                                                                        Encrypted:false
                                                                        SSDEEP:3:YEPMxilI5dSPppv:Yccfgppv
                                                                        MD5:5C6F2CA9408DEE38EF6CB44FDBC49C2B
                                                                        SHA1:79E05E85BC156B203373D28405E898876C47A557
                                                                        SHA-256:7D9D14E40566109ED303E3979B4DF2CC07FBEF3C8AB95F26663885A8329719F6
                                                                        SHA-512:78A989B804552A6E14535FAF9D4362CB9078871B16AE98CC56BF1104556F33606250104027419FD2D94EE206AF226EE2A822537AF46B8B585FC8308E6EFF3754
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT..

                                                                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:modified
                                                                        Size (bytes):623
                                                                        Entropy (8bit):7.64872464178746
                                                                        Encrypted:false
                                                                        SSDEEP:12:dZyIfaaFBRRHi6XUMGW3nFxPbAZ2IGgfY0dR8bA60tooXYSeWcii9a:dZ7fdVuynFxPbAIIGgfHdR/DzeWbD
                                                                        MD5:837A977547DE3A1EBE14099DCCA492B9
                                                                        SHA1:551CFFCDB120E9245E8B2688EF5C58F04F0823CB
                                                                        SHA-256:0BEE663EF96ECA28CD83D3EF214C5792A0302DF8BE442D7E44C9C67B3915FD8F
                                                                        SHA-512:B1C346F63960FFB75ADCC8D9AB74AE089DD2A10D64DD68675C43FE113812143C943BC81704522E562089C2E2555DE83517FDE62F8F0F7DC820727C4C076E3284
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:2020/3..w..w...?...&..b..$#}`.q.6W..b.H...<....Wwy......8>......;./..7.:.T7E.. .<...>.-...ua..............L.v..."............1I.?.N*.......{..w...R...?....Z.....f$$..~^\..>].B.*......T.d3L..o.j...!^G)....QF.|K....$...M.9.E..e'.".:o.].xi........;K[{.N........}q&w..piR................^Om.%._.Jx..B.\...../.D.W.. .e..w.....-.`M.U..U...6^...}..c......6....}._.0=.<.:m.C.O..t.8.....y.".>..5..b...gcd...Y.l.wK.3b.8.....6..t5r.)....V..%.@&`..i...~.L.Db..=...U#0\.M.LNe....3..7.>+..Y0xn..[..>....U8....n..8.....b....$$..lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):623
                                                                        Entropy (8bit):7.64872464178746
                                                                        Encrypted:false
                                                                        SSDEEP:12:dZyIfaaFBRRHi6XUMGW3nFxPbAZ2IGgfY0dR8bA60tooXYSeWcii9a:dZ7fdVuynFxPbAIIGgfHdR/DzeWbD
                                                                        MD5:837A977547DE3A1EBE14099DCCA492B9
                                                                        SHA1:551CFFCDB120E9245E8B2688EF5C58F04F0823CB
                                                                        SHA-256:0BEE663EF96ECA28CD83D3EF214C5792A0302DF8BE442D7E44C9C67B3915FD8F
                                                                        SHA-512:B1C346F63960FFB75ADCC8D9AB74AE089DD2A10D64DD68675C43FE113812143C943BC81704522E562089C2E2555DE83517FDE62F8F0F7DC820727C4C076E3284
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:2020/3..w..w...?...&..b..$#}`.q.6W..b.H...<....Wwy......8>......;./..7.:.T7E.. .<...>.-...ua..............L.v..."............1I.?.N*.......{..w...R...?....Z.....f$$..~^\..>].B.*......T.d3L..o.j...!^G)....QF.|K....$...M.9.E..e'.".:o.].xi........;K[{.N........}q&w..piR................^Om.%._.Jx..B.\...../.D.W.. .e..w.....-.`M.U..U...6^...}..c......6....}._.0=.<.:m.C.O..t.8.....y.".>..5..b...gcd...Y.l.wK.3b.8.....6..t5r.)....V..%.@&`..i...~.L.Db..=...U#0\.M.LNe....3..7.>+..Y0xn..[..>....U8....n..8.....b....$$..lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\2EM0SFDW\www.msn[1].xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):347
                                                                        Entropy (8bit):7.2400977603273935
                                                                        Encrypted:false
                                                                        SSDEEP:6:YEqaq8cuk4Fsrxrut1cULu8zcrt5qucouz35U/JzIbZoBgccfgpfWcii96Z:rqa2uk4mdutCS5zozq86CBgeWcii9a
                                                                        MD5:58ACEF7A4FFE9A64D5B335A47FB5A743
                                                                        SHA1:E0F173AAFBA13646D78E39B65A3EDBD1CBB44B9B
                                                                        SHA-256:22E7156D0F310052C026CAE9680562E67AD5D15720F681BBAFFF02035BC09D32
                                                                        SHA-512:86C1EA5195C03A2531B9599449CBD05A734C950E738ABE57329305EE05B3F1D1ACA519F78138D56FA08A0C11475F473A2D3B8156B57190F2D27B6E568C9EA9E8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root.Y@..[.;........T..r^..,......Qk.!w6\..w.y......<`.6.........L.&./...C.0l.zX.,..(.??..0...5".|...7c..~...7......H7....U:..O*.I7.jt.p3....AI.7L.*c..y..........!..A.......G..y-U..~.W...:.....rO.F.XM6....G...`.X.:..>y.M4G..#7..Y..@..-...GJ\.SN..u.@@.[MWw.o..8JlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\2EM0SFDW\www.msn[1].xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):347
                                                                        Entropy (8bit):7.2400977603273935
                                                                        Encrypted:false
                                                                        SSDEEP:6:YEqaq8cuk4Fsrxrut1cULu8zcrt5qucouz35U/JzIbZoBgccfgpfWcii96Z:rqa2uk4mdutCS5zozq86CBgeWcii9a
                                                                        MD5:58ACEF7A4FFE9A64D5B335A47FB5A743
                                                                        SHA1:E0F173AAFBA13646D78E39B65A3EDBD1CBB44B9B
                                                                        SHA-256:22E7156D0F310052C026CAE9680562E67AD5D15720F681BBAFFF02035BC09D32
                                                                        SHA-512:86C1EA5195C03A2531B9599449CBD05A734C950E738ABE57329305EE05B3F1D1ACA519F78138D56FA08A0C11475F473A2D3B8156B57190F2D27B6E568C9EA9E8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root.Y@..[.;........T..r^..,......Qk.!w6\..w.y......<`.6.........L.&./...C.0l.zX.,..(.??..0...5".|...7c..~...7......H7....U:..O*.I7.jt.p3....AI.7L.*c..y..........!..A.......G..y-U..~.W...:.....rO.F.XM6....G...`.X.:..>y.M4G..#7..Y..@..-...GJ\.SN..u.@@.[MWw.o..8JlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\NJ1L9FBN\www.google[1].xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):511
                                                                        Entropy (8bit):7.4717738447149005
                                                                        Encrypted:false
                                                                        SSDEEP:12:Ug17Ln9n41NIz8DSp+PBQoK+oUdopRh1cXjWcii9a:U6Lna1y7CdWpj1czWbD
                                                                        MD5:0F2DC9CF0CC29A375745DC3ADA5AE18B
                                                                        SHA1:D635AE6195D87E16771FC4BDA11AB29F83DD203B
                                                                        SHA-256:BD768F615CE5D6B6436D0B59C10FA6940C261D197CDA421BD93B353465503AC4
                                                                        SHA-512:287A653A8DC05288C9F346889A85FE8BA74B701B8D6FD43A03BAF0E4468345D4E433AA9DAB961FD960E5D48805F2E8A9A9D798202553237E53B5731C6F02867B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root...)Z..e.j........\;..0.^.b......W.j.....$....X.=..aY.}TT].....0.;.5G\.~.`..I5.-.F./...-ze....2..E..)#O..o.EY............m..s:.K.!.......#.x.92#}w...D+.H....;.:g.p..$.s.>.}.ft............#.2....XI}...>P._..0.w.e2....H.....I.g4..k~.g_.=.LY./.....$.s6.....nf.h...9...b..+..........x...1.n.B1r...m,...R...(..{I..Kf.w>.@....1a........_.x...{..j"9El....B.*..-xF......I!x....0k.st...k.o0`A.?./*.n...BZR58. E.|f1.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\NJ1L9FBN\www.google[1].xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):511
                                                                        Entropy (8bit):7.4717738447149005
                                                                        Encrypted:false
                                                                        SSDEEP:12:Ug17Ln9n41NIz8DSp+PBQoK+oUdopRh1cXjWcii9a:U6Lna1y7CdWpj1czWbD
                                                                        MD5:0F2DC9CF0CC29A375745DC3ADA5AE18B
                                                                        SHA1:D635AE6195D87E16771FC4BDA11AB29F83DD203B
                                                                        SHA-256:BD768F615CE5D6B6436D0B59C10FA6940C261D197CDA421BD93B353465503AC4
                                                                        SHA-512:287A653A8DC05288C9F346889A85FE8BA74B701B8D6FD43A03BAF0E4468345D4E433AA9DAB961FD960E5D48805F2E8A9A9D798202553237E53B5731C6F02867B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root...)Z..e.j........\;..0.^.b......W.j.....$....X.=..aY.}TT].....0.;.5G\.~.`..I5.-.F./...-ze....2..E..)#O..o.EY............m..s:.K.!.......#.x.92#}w...D+.H....;.:g.p..$.s.>.}.ft............#.2....XI}...>P._..0.w.e2....H.....I.g4..k~.g_.=.LY./.....$.s6.....nf.h...9...b..+..........x...1.n.B1r...m,...R...(..{I..Kf.w>.@....1a........_.x...{..j"9El....B.*..-xF......I!x....0k.st...k.o0`A.?./*.n...BZR58. E.|f1.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\WP4N5YVD\contextual.media[1].xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):500
                                                                        Entropy (8bit):7.5102384061732135
                                                                        Encrypted:false
                                                                        SSDEEP:12:p4DKfXAHChdyqdmES4DmvgB0Z4VpOPQjUxWcii9a:OVH8dyqdmEcDZ4jgxWbD
                                                                        MD5:F6765460130C536B833FEBB3B2F112A7
                                                                        SHA1:FF2D79CBF43715B284A793C3E2DF4BE16E2A1DF6
                                                                        SHA-256:7F5008B46B1839999DCC1395E9CA36CFEF680FEEFE70916AC436CAF60E5D776B
                                                                        SHA-512:BAD2368F57E20644901756D9ABBCA0551E75B7CB25BB50C232811B99AE81BEFE46391F5631C13AB07F1554778CD749B559EF2516B60D0567B6A77A1DF4E25979
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root^..].q.\.5.D.".C.*=c.\w.SqR.y.....W.......3h.U..q<.r.,f..m...!tV.."....H......c..J%...L`..~.\.......)H..Os_.8_r......M....D@av.-.6..ol9..9e..._....F....Tw.].w.T.... sO.....b.{...X.5j.....MID....?.....%.......E......?d..e.%..w..\tDh...g...."...EI<J..E .\.i...'.1...Ia....... ....q..x..........?.=...-.M...B..#......".7L3S....b.\.3.T;...p.\..r......N...9.`....#.o.!.W......q>........-_]G}...+..tYlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\WP4N5YVD\contextual.media[1].xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):500
                                                                        Entropy (8bit):7.5102384061732135
                                                                        Encrypted:false
                                                                        SSDEEP:12:p4DKfXAHChdyqdmES4DmvgB0Z4VpOPQjUxWcii9a:OVH8dyqdmEcDZ4jgxWbD
                                                                        MD5:F6765460130C536B833FEBB3B2F112A7
                                                                        SHA1:FF2D79CBF43715B284A793C3E2DF4BE16E2A1DF6
                                                                        SHA-256:7F5008B46B1839999DCC1395E9CA36CFEF680FEEFE70916AC436CAF60E5D776B
                                                                        SHA-512:BAD2368F57E20644901756D9ABBCA0551E75B7CB25BB50C232811B99AE81BEFE46391F5631C13AB07F1554778CD749B559EF2516B60D0567B6A77A1DF4E25979
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root^..].q.\.5.D.".C.*=c.\w.SqR.y.....W.......3h.U..q<.r.,f..m...!tV.."....H......c..J%...L`..~.\.......)H..Os_.8_r......M....D@av.-.6..ol9..9e..._....F....Tw.].w.T.... sO.....b.{...X.5j.....MID....?.....%.......E......?d..e.%..w..\tDh...g...."...EI<J..E .\.i...'.1...Ia....... ....q..x..........?.=...-.M...B..#......".7L3S....b.\.3.T;...p.\..r......N...9.`....#.o.!.W......q>........-_]G}...+..tYlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\YU3ONM33\www.microsoft[1].xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):570
                                                                        Entropy (8bit):7.619597217555201
                                                                        Encrypted:false
                                                                        SSDEEP:12:ScVDPEvlfhVyyivLEokEdE0GheRpYhzL8hL+FMDZc7Wcii9a:SeDPC3MbpdFGhEhB+F2QWbD
                                                                        MD5:B50A75F9F0DAE67F8653ADEC3FF225B6
                                                                        SHA1:B86FD71E97C6DF0555FA96744E0D01391527E26E
                                                                        SHA-256:187AFE3CA215B151FDCBE5CFB94ED4BD1A0A940F9C31326AEE555FC95BD7D41A
                                                                        SHA-512:3838939AD3219DB9979C907A4547F3BB32DF91C99D30F21B5728655821DE44D7795EA19B84245F3187FA7174F7F15883D15E588E9D0B1BB2FB4BA954C0761C41
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root.^.n...z...6p.x....d......>n....._..5.....[;F.`v.....,z.iP....B.[.K..%.1.@..(...oa..N,[:88.ft4.k.@.u..H......[."~.]....m.[<;.+.A2.k.4"[.......g./........|!.M..y..57..........WN............q&7."..Wo<...u.\.}.Ac...w".}(/[B.%..E.w....J.o.(.....>..6..+.u...L...C.w6(_&0.o8..{l.k...W.I....l.:...6.}..F.>...5.....v.O.....S.4.f.r&.+y..(.X.tj......h..s........4...B..c....hV..I.8....9.....=......y.g.^.U.......[.7A .A.......Y. ..$.#.S..-M.R|..3#uv..15.P......t.N./o.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\YU3ONM33\www.microsoft[1].xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):570
                                                                        Entropy (8bit):7.619597217555201
                                                                        Encrypted:false
                                                                        SSDEEP:12:ScVDPEvlfhVyyivLEokEdE0GheRpYhzL8hL+FMDZc7Wcii9a:SeDPC3MbpdFGhEhB+F2QWbD
                                                                        MD5:B50A75F9F0DAE67F8653ADEC3FF225B6
                                                                        SHA1:B86FD71E97C6DF0555FA96744E0D01391527E26E
                                                                        SHA-256:187AFE3CA215B151FDCBE5CFB94ED4BD1A0A940F9C31326AEE555FC95BD7D41A
                                                                        SHA-512:3838939AD3219DB9979C907A4547F3BB32DF91C99D30F21B5728655821DE44D7795EA19B84245F3187FA7174F7F15883D15E588E9D0B1BB2FB4BA954C0761C41
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<root.^.n...z...6p.x....d......>n....._..5.....[;F.`v.....,z.iP....B.[.K..%.1.@..(...oa..N,[:88.ft4.k.@.u..H......[."~.]....m.[<;.+.A2.k.4"[.......g./........|!.M..y..57..........WN............q&7."..Wo<...u.\.}.Ac...w".}(/[B.%..E.w....J.o.(.....>..6..+.u...L...C.w6(_&0.o8..{l.k...W.I....l.:...6.}..F.>...5.....v.O.....S.4.f.r&.+y..(.X.tj......h..s........4...B..c....hV..I.8....9.....=......y.g.^.U.......[.7A .A.......Y. ..$.#.S..-M.R|..3#uv..15.P......t.N./o.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 71%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 22%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\3DW8qUWA963x8XKarJJ0WTU1.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 4%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 71%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\3e7TFXuOpvanKkAtgXUBsjg5.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build2.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):323584
                                                                        Entropy (8bit):7.335727279150543
                                                                        Encrypted:false
                                                                        SSDEEP:6144:mrOIfGAgfLPJh+pqv1h2mACim82mmNOG5RTt2MU83ZYgdit1oTk:mrxY1gpqvz2mY0t7t2P6YBP4
                                                                        MD5:B298C49F1808CC5D93DCC3DFC088B10F
                                                                        SHA1:C0B8E909D0EF573E0F5A4E25870A63F3F6EE1306
                                                                        SHA-256:FFAED8DCF0282DF833B74FAF419729DC20951EE7EDBB58103FA5C582E93D5F3A
                                                                        SHA-512:1B75AEAA793B5AA92769F68BB0F677206394F5B28E7AC1A23F6BE923AF812A5A9033920AF0C2DE1E6805E46A5C9EC283DDECD879B1264D75D7B4190266028895
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 96%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d.@...@...@...^...^...^...p...^......gmq.G...@......^...A...^...A...^...A...Rich@...................PE..L.....@b.............................\....... ....@.............................................................................P....0..............................@................................H..@............................................text............................... ..`.data........ ...0..................@....rsrc........0.......D..............@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):9728
                                                                        Entropy (8bit):5.3362059272001
                                                                        Encrypted:false
                                                                        SSDEEP:192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
                                                                        MD5:9EAD10C08E72AE41921191F8DB39BC16
                                                                        SHA1:ABE3BCE01CD34AFC88E2C838173F8C2BD0090AE1
                                                                        SHA-256:8D7F0E6B6877BDFB9F4531AFAFD0451F7D17F0AC24E2F2427E9B4ECC5452B9F0
                                                                        SHA-512:AA35DBC59A3589DF2763E76A495CE5A9E62196628B4C1D098ADD38BD7F27C49EDF93A66FB8507FB746E37EE32932DA2460E440F241ABE1A5A279ABCC1E5FFE4A
                                                                        Malicious:true
                                                                        Yara Hits:
                                                                        • Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, Author: unknown
                                                                        • Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: C:\Users\user\AppData\Local\4204bcd2-893f-40a6-aea5-23bed3094b06\build3.exe, Author: unknown
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 82%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................o......o......Rich...........................PE..L......a.....................................0....@..........................`............@..................................:..<............................P..,....9..8............................................0..0............................text............................... ..`.rdata.......0......................@..@.data...`....@......................@....reloc..,....P......."..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\45jOwggrSgiiBeW99lMmxS6j.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\7BzwsLUKsvJRsr2MzRqYN9bI.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 71%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\8jjMtFTS9Zlbf6vKPpWxHhte.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768505936227056
                                                                        Encrypted:false
                                                                        SSDEEP:49152:7+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4v0:qwrGHip8nfzyeJaipzW88gLv0
                                                                        MD5:B60798160BDEF2489816A87DC1526D92
                                                                        SHA1:8ECAFF687658E70AB2F49D710A91F3006EB4C7FD
                                                                        SHA-256:F974E0DABD6D8AE8F6B613D6B48C00871DD71BC68FA994892CFE543FB7988780
                                                                        SHA-512:4B49B88D9729247923B4EB3653DE4F93E67640E55335B8405FCA3E82A22A4F65BE2CF274DED521A90CFDF35ED0BC20F9B24CCD1FB405BFCF75D134CCE8DA7D5F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......[,...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\AppData\Local\90MmY3vsUc9ABzZegEZBdNOJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\9rjyJ5VsLUcAN5cWEKCTLeAn.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 4%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\AboFkE91gGtC0jX22BS3GOn1.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 35%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\AppData\Local\BYpvSgsqBQF2e9VWX5DwhO9b.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 22%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\CluIFFuzrOPmXrVReYWFXWkl.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\DFhwCIhHEDQ5pEOtcRuwyHkl.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\DOlWVdd6vAc9n834oatrVt00.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 70%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\G2DNcZFdbZ5vEmNAUVLs9Ohf.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\b7e4c0503c392ad23e181d12e1775bfc

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe
                                                                        File Type:SQLite 3.x database, last written using SQLite version 3041002, file counter 24, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 24
                                                                        Category:dropped
                                                                        Size (bytes):28672
                                                                        Entropy (8bit):2.1205625672251087
                                                                        Encrypted:false
                                                                        SSDEEP:96:cephLnwke2HOPYeTdPC5ss/9DvJ9S0Rwhba5DXMcF0jMoiUZepk8U7MiRmgmdBv:cNBdPC5lF7JlRwE5QjoD1U7MiArZ
                                                                        MD5:02837B0227A4435A23DA1AA7256FD333
                                                                        SHA1:4E04DCD998641CD9CD1BA94423008FB88AAFBDEA
                                                                        SHA-256:13133F5A0C72E224C1CA61F5C4EE66FAEEFF0AEF5B407BE5B6B223559F721EF8
                                                                        SHA-512:AFB9BAC4743EECED456797D7FFE354A22BC320B1F8A8DAE68DD2E6394F3580D64615E1511583C7ED5CD5337711D315E244A0437C3E6CC09CA8BF0E619598DC27
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:SQLite format 3......@ ..........................................................................f..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\HUWYuskBZsBLIvSLkwJtR64k.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\HZmkan0RtnpmEbbLPyds7uQ6.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Avira, Detection: 100%
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\MgZKvMc7DV5RedICsSIU2R0o.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768505904990782
                                                                        Encrypted:false
                                                                        SSDEEP:49152:j+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vh:iwrGHip8nfzyeJaipzW88gLvh
                                                                        MD5:683FD05249FB77692A53B62785167B77
                                                                        SHA1:C74C9BE4A19A64F3B396EB2FE32B0C5A55C75019
                                                                        SHA-256:9AD6B70AC5F50EF97B346913D34588E24F762E95B737CBA7138D7173AE64E2B1
                                                                        SHA-512:DE459AE3EEFB2FB7534D0C1651DA26C3629DC82926ABB8827E9F288F8A01500AEABFA7A0F7AE729D830610DF02B69C79A9D2D47A1FA71DFD73D5917A5109525E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......W,...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):984
                                                                        Entropy (8bit):5.227423502376633
                                                                        Encrypted:false
                                                                        SSDEEP:24:Yq6CUXyhm5IUmtQlbNdB6hm5VUmtQlz0Jahm5SUmtQlHZ6T06Mhm5vUmtQlbxdB8:YqDUXycIwbNdUcpwz0JacWwHZ6T06Mcb
                                                                        MD5:D9512E54D33D06E68E0C0D36726F7776
                                                                        SHA1:2E2ED852C188E0F96FCF861D7B73B8C479379845
                                                                        SHA-256:C70B840F192B885EF63C8426B0667EF175424A96DEC79A988C9525AD8E6997D2
                                                                        SHA-512:AAFCD49F2C87D4D43076CB4C1357FFAC9AB224ADBD4CEB06961755A0D6305D550090DDA34CAAA3C9B2700EF182CC9D6000BAB87A1A31D15A6A9F7565F60BA515
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{"RecentItems":[{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":2360844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2350844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":2340844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":2330844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2320844864,"LastSwitchedHighPart":30747916,"PrePopulated":true},{"AppID":"Microsoft.Getstarted_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2310844864,"LastSwitchedHighPart":30747916,"PrePopulated":true}]}

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1]

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1826208
                                                                        Entropy (8bit):7.978777574746798
                                                                        Encrypted:false
                                                                        SSDEEP:49152:rkQTAVchw7doMe+3u+ZVWpGPUMfN7YFRM1UN5:raVchwhd3uolPpfdcCM5
                                                                        MD5:878FEE717881CD44FBD351816A653142
                                                                        SHA1:8AEFBF1CEFF42F90980CB054BC6AC90089A4F014
                                                                        SHA-256:55BF635BE312162A07A1F07AADA3796DC672C8342BADEC00DD33F5E458AAB456
                                                                        SHA-512:7E21B7BB78D2D6F3391CCF3DFA6D7F87D12E8719506FD80594DB4F431CB0DD15E0C63EBF11FFCB0B66AFBBB16BF5B51EF9BE4B541EFEBF0424C41172E1AF189E
                                                                        Malicious:true
                                                                        Yara Hits:
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1], Author: Joe Security
                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s51[1], Author: ditekSHen
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        • Antivirus: ReversingLabs, Detection: 17%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~................j.......PE..L...t..P..........#................./.............@..................................;..........................................P....`...P...........r...k..............................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc....P...`...R... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\s52[1].htm

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        File Type:very short file (no magic)
                                                                        Category:dropped
                                                                        Size (bytes):1
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3:A:A
                                                                        MD5:E1671797C52E15F763380B45E841EC32
                                                                        SHA1:58E6B3A414A1E090DFC6029ADD0F3555CCBA127F
                                                                        SHA-256:3F79BB7B435B05321651DAEFD374CDC681DC06FAA65E374E38337B88CA046DEA
                                                                        SHA-512:87C568E037A5FA50B1BC911E8EE19A77C4DD3C22BCE9932F86FDD8A216AFE1681C89737FADA6859E91047EECE711EC16DA62D6CCB9FD0DE2C51F132347350D8C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:e

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\s53[1].htm

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        File Type:very short file (no magic)
                                                                        Category:dropped
                                                                        Size (bytes):1
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3:A:A
                                                                        MD5:E1671797C52E15F763380B45E841EC32
                                                                        SHA1:58E6B3A414A1E090DFC6029ADD0F3555CCBA127F
                                                                        SHA-256:3F79BB7B435B05321651DAEFD374CDC681DC06FAA65E374E38337B88CA046DEA
                                                                        SHA-512:87C568E037A5FA50B1BC911E8EE19A77C4DD3C22BCE9932F86FDD8A216AFE1681C89737FADA6859E91047EECE711EC16DA62D6CCB9FD0DE2C51F132347350D8C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:e

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build2[1].exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):323584
                                                                        Entropy (8bit):7.335727279150543
                                                                        Encrypted:false
                                                                        SSDEEP:6144:mrOIfGAgfLPJh+pqv1h2mACim82mmNOG5RTt2MU83ZYgdit1oTk:mrxY1gpqvz2mY0t7t2P6YBP4
                                                                        MD5:B298C49F1808CC5D93DCC3DFC088B10F
                                                                        SHA1:C0B8E909D0EF573E0F5A4E25870A63F3F6EE1306
                                                                        SHA-256:FFAED8DCF0282DF833B74FAF419729DC20951EE7EDBB58103FA5C582E93D5F3A
                                                                        SHA-512:1B75AEAA793B5AA92769F68BB0F677206394F5B28E7AC1A23F6BE923AF812A5A9033920AF0C2DE1E6805E46A5C9EC283DDECD879B1264D75D7B4190266028895
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 96%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d.@...@...@...^...^...^...p...^......gmq.G...@......^...A...^...A...^...A...Rich@...................PE..L.....@b.............................\....... ....@.............................................................................P....0..............................@................................H..@............................................text............................... ..`.data........ ...0..................@....rsrc........0.......D..............@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):9728
                                                                        Entropy (8bit):5.3362059272001
                                                                        Encrypted:false
                                                                        SSDEEP:192:9UEc8b6H1LE+4LoGgMatAJ2lzUw317NyEpvNHhqyo:9UUE1BYoGza/D3170kiyo
                                                                        MD5:9EAD10C08E72AE41921191F8DB39BC16
                                                                        SHA1:ABE3BCE01CD34AFC88E2C838173F8C2BD0090AE1
                                                                        SHA-256:8D7F0E6B6877BDFB9F4531AFAFD0451F7D17F0AC24E2F2427E9B4ECC5452B9F0
                                                                        SHA-512:AA35DBC59A3589DF2763E76A495CE5A9E62196628B4C1D098ADD38BD7F27C49EDF93A66FB8507FB746E37EE32932DA2460E440F241ABE1A5A279ABCC1E5FFE4A
                                                                        Malicious:true
                                                                        Yara Hits:
                                                                        • Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, Author: unknown
                                                                        • Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\build3[1].exe, Author: unknown
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 82%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................o......o......Rich...........................PE..L......a.....................................0....@..........................`............@..................................:..<............................P..,....9..8............................................0..0............................text............................... ..`.rdata.......0......................@..@.data...`....@......................@....reloc..,....P......."..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\get[1].htm

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):559
                                                                        Entropy (8bit):6.004259360523156
                                                                        Encrypted:false
                                                                        SSDEEP:12:YGJ68UMQMuFhwufi+Cv2OHbW2/lBtrYrHw0J/6X+yN55z:YgJURMChni1v2OHbWGls6X+yzh
                                                                        MD5:E085EE40110A62687426D9912F76BA0A
                                                                        SHA1:570129022D1257B25E4E41179B1FCE484E35E173
                                                                        SHA-256:249D09D2B2F601F13AEC42E8C656C5612F0400477C724CB6E8A6D26EEC845D57
                                                                        SHA-512:F3088B4637A73FF917318930CB9F69FA7CF9ACB2924E8A001C20A502461DED42A2BE035BF16792274A2F5486539544CFE2C1EE1A997623788545195CAB7ACD4F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz6fKeRUzAuT51Jzl25x1\\n6rIH8kP+Za9iV6o7RJzhAukJBNh9iYpD3z0BRtUYY7G4lSqjMRJHR1eReiKKJE5D\\nwyflo\/4NUlBJ5QA4zFAamyP3ajU0BVX3dse65p5r7K7wALsdMLsXg+x8YRkQSBVr\\nQPROSOgYJZmDe+9g5QdWb40\/vPP+oKyceFvfPiWyf6tzEwOzihxGQDJ1ZghRh3Si\\nFMLoHm8blxwJ3u3xq6lhIsaZNJ1aX\/RbynaXSz6NU3VpFSgC00CoYAYPHcVY6aWe\\nj+iMeY\/mLAYeK\/rE8JZxbksETfAU3HEiN7S7k6clRlzwmkVfSwE6epDUR4dzTQUF\\nYQIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT"}

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\imagd[1].jpg

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe
                                                                        File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1080x1440, components 3
                                                                        Category:dropped
                                                                        Size (bytes):1507532
                                                                        Entropy (8bit):6.924614893541949
                                                                        Encrypted:false
                                                                        SSDEEP:24576:SMaEt+i3CrC7CI9TZDEWk1wCy0zaG9cQAH1ftxmbfYQJZKaz+:SIoiOI99DEWVtQAHZmn0U
                                                                        MD5:89623E56516BF90ADE8859DB34BEC9E9
                                                                        SHA1:476C44FDDC5C929D879B02FB91D941B44707EEE3
                                                                        SHA-256:6597769607C0143B7201F47CA1A73FC28CF2E063416B9006699065354282C6FA
                                                                        SHA-512:50E3D45327E70A996C2A99C834837CBF32B9D115600BF0A43CF58EB9BA2FC68DDA3CDEEEBD5AEE3CDDC4EBC7EFCA77DF75C020A8E80AACAEDBF3CF405BDA3240
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:......JFIF.............C....................................................................C.........................................................................8............................................c.........................!.."1A.2Q.#BRaq3br............$4CS...c....%s.....&5DTd..'6EUet....7F.....................................>......................!.1.A..."2Qa.#3q..B....$4...C.DRr.b..............?....{.e..#y.|..,....P.b...?...'(..+....#.....B....:,9=.o5..,.b...M:,rP.w....<.C1......&.....lP....OrP.rZ....P,M.y"...,.....@X..oD..@;: ,......$...P.p.....pg....:.<.......;...8..B.......)..,........a.. ..!.!0..r.P..*.....f.....O..t*...o.'...[.....o`h..4.m|,..G....<<0@.?.F.*R7Sd...e.@.._.@...j..FGy.,..{..0.X..6.h7...E..wF..r..nl.Yp....o....j`..T...Y].7.m.J.a....g..@..,..<L.TD.Ra...u.....BS.\......+><{N8.rA....G..#....n.....F......|#.;....Bs..n6....a..|..5d...g..|.w.4...}...I|....S..>........aRW;~g..y.I4_)....)...(v.w.............]2.k}>P...^...|..=.c.u...V

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s51[1]

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1826208
                                                                        Entropy (8bit):7.978777574746798
                                                                        Encrypted:false
                                                                        SSDEEP:49152:rkQTAVchw7doMe+3u+ZVWpGPUMfN7YFRM1UN5:raVchwhd3uolPpfdcCM5
                                                                        MD5:878FEE717881CD44FBD351816A653142
                                                                        SHA1:8AEFBF1CEFF42F90980CB054BC6AC90089A4F014
                                                                        SHA-256:55BF635BE312162A07A1F07AADA3796DC672C8342BADEC00DD33F5E458AAB456
                                                                        SHA-512:7E21B7BB78D2D6F3391CCF3DFA6D7F87D12E8719506FD80594DB4F431CB0DD15E0C63EBF11FFCB0B66AFBBB16BF5B51EF9BE4B541EFEBF0424C41172E1AF189E
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 17%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~................j.......PE..L...t..P..........#................./.............@..................................;..........................................P....`...P...........r...k..............................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc....P...`...R... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\s54[1].htm

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        File Type:very short file (no magic)
                                                                        Category:dropped
                                                                        Size (bytes):1
                                                                        Entropy (8bit):0.0
                                                                        Encrypted:false
                                                                        SSDEEP:3:A:A
                                                                        MD5:E1671797C52E15F763380B45E841EC32
                                                                        SHA1:58E6B3A414A1E090DFC6029ADD0F3555CCBA127F
                                                                        SHA-256:3F79BB7B435B05321651DAEFD374CDC681DC06FAA65E374E38337B88CA046DEA
                                                                        SHA-512:87C568E037A5FA50B1BC911E8EE19A77C4DD3C22BCE9932F86FDD8A216AFE1681C89737FADA6859E91047EECE711EC16DA62D6CCB9FD0DE2C51F132347350D8C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:e

                                                                        C:\Users\user\AppData\Local\Mrqt0LPomy7YxUAwjV5w1C4Z.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\NjXePrSynHsARTml2YUxC7hl.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\OdBy5UCgwCs2zOQ5hgwqYDDW.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 78%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\PEETw0QK3zD9r7HEE5AR45AO.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 35%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\AppData\Local\QmwuUY15y0L4DcEZ4ogFMHTp.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 22%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\SVKcZYT3TwUPvLXOcZVQMjWE.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768503498951888
                                                                        Encrypted:false
                                                                        SSDEEP:49152:H+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vU:ewrGHip8nfzyeJaipzW88gLvU
                                                                        MD5:F9B6E38B80259C82674A2E043A66507F
                                                                        SHA1:DB2B2057B43D77DC212C20D9DF3A7A3B8BC9655B
                                                                        SHA-256:FE0B9B9A8624551FBEEB578BEBBCD5647CBC5FBF757B463A7A435B9D3BCD300C
                                                                        SHA-512:2B4C4AA4B4BA1C1781DF4D7836A933090397D104E31EDC3A838C0D6FB7BB8EF1F16EEBA09A762631228D9C729BF4B1C440FF1A8832F7EABB868D1FDC8880B4F2
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS.......-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\AppData\Local\SXfcayqkk1DZ7GAEIik6FBEC.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 22%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\TNzDEBB9FdUrEB9ZmBfj0vTU.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\TUpbZ8vU8BuCVac1Gcxet4HJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 70%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\Tc3J3MYPBvAb1zFAQ5lDv3bp.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 78%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\25C8.dll

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1683456
                                                                        Entropy (8bit):7.954761672845403
                                                                        Encrypted:false
                                                                        SSDEEP:49152:x54IMZlbSmF7gJqITyEIpid3WpGUvuF3:xyZl2mOE83dyuF3
                                                                        MD5:9B9F5BBDB27F30FFB9EDDEC2DF39137E
                                                                        SHA1:92C46DCD23FCDA7D0D53E1A49F9A4D3E9684D054
                                                                        SHA-256:7EAEBDA0F4C88C43D8DE32202090C3E158F5F25CF8DCEF20A46B4EB0D72CD4BC
                                                                        SHA-512:33DEF0EEAD3FADF32BA0C5DA7E626986B7A928AF2F0CB4D480D1C422737581332D63ACD2795A3BD793916B2A074F809D699D9732D81C23373C2620E76DDFC675
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@.......................................&^..b?..b?..b?....p.y>...[D..?....q."?....w.P?..b?...?....q.E>..E.r..>..|m?.C?...f...>...I..M>..E.r..>..|m?.w?...a...>..|m*..>..y....?..|m?..>...e.`>..y...>?...aD..?..Richb?..........................PE..L......e...........!.....P... ......-".......`.......................................................................m..^...Xd.......p..........................` ...a...............................................`..t............................text....I.......P.................. ..`.rdata.......`.......`.................@.data...P....p.......p..............@...CODE.....$...@...0...0..............@....rsrc........p.......`..............@..@.reloc..>0.......@...p..............@..B........................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\2629.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):837120
                                                                        Entropy (8bit):7.32762455815464
                                                                        Encrypted:false
                                                                        SSDEEP:12288:YBDAUXwqzvevScTOFyqOEhz3txgdEGtKGjRQR/q18co3jqCHJT:VWzWvS7FNOEJ3Mdt8GQpcuJ
                                                                        MD5:C082D1BA8C66D2C5ADEE770992C8C249
                                                                        SHA1:B32B610C10181CD4DAD3C40E7A86C709F6127FC2
                                                                        SHA-256:DC22F70898991DB18EA5974191E1509BDB7A10BFC3B02333A4965AF6374A0375
                                                                        SHA-512:CEB59C18FFF468974B2C4F35922459D8BE91D760368FBDA9E1E6D9E485E53848A6745DB0A9375E7BE13D16F7362CF21F87E256BE1D9CAE31233C88726199E194
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 53%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...7..b.............................T............@...........................!.....>j..........................................d.....!.P...........................................................XB..@............................................text............................... ..`.data...DL.......>..................@....rsrc...P.....!.....................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\2CED.bat

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):77
                                                                        Entropy (8bit):4.90323175550411
                                                                        Encrypted:false
                                                                        SSDEEP:3:u3Pvrmwqp2YR3sGJMGP5Rg5XQiKyMhF7n:uPzmg83JMuBi67
                                                                        MD5:55CC761BF3429324E5A0095CAB002113
                                                                        SHA1:2CC1EF4542A4E92D4158AB3978425D517FAFD16D
                                                                        SHA-256:D6CCEB3C71B80403364BF142F2FA4624EE0BE36A49BAC25ED45A497CF1CE9C3A
                                                                        SHA-512:33F9F5CAD22D291077787C7DF510806E4AC31F453D288712595AF6DEBE579FABED6CDF4662E46E6FA94DE135B161E739F55CFAE05C36C87AF85ED6A6AD1C9155
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

                                                                        C:\Users\user\AppData\Local\Temp\2D42.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):313856
                                                                        Entropy (8bit):5.418767533730257
                                                                        Encrypted:false
                                                                        SSDEEP:3072:Wwl8ZN0L7ba/0p1SZ2rqHddCkaiSGPKeDOjcQlHkzHRse9zsMLU0lvS:tl8/0nba/0GZCqHDCrgP27yxse9z7
                                                                        MD5:8489787B83368ED020E05F9B27EDB287
                                                                        SHA1:987AA01E327C4433FA23857EB8ABBF113A4ACECD
                                                                        SHA-256:5CCBF427664CDBE8CFF5E9BE607256EDFC54CF258C64BA176F9D981AB9269B5F
                                                                        SHA-512:D3F6BE66DEF2E5D882F9D5B8B9CAB35692D4F4BD82EA5F272AF518EDD6606E9A75C611BBF51B524103C48DAB61A9DEF7DCD782A5CC687DB43EE1832B0FF9DC17
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L......b.............................T............@.................................@.......................................t...d....................................................................B..@............................................text............................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\3958.dll

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1683456
                                                                        Entropy (8bit):7.954761672845403
                                                                        Encrypted:false
                                                                        SSDEEP:49152:x54IMZlbSmF7gJqITyEIpid3WpGUvuF3:xyZl2mOE83dyuF3
                                                                        MD5:9B9F5BBDB27F30FFB9EDDEC2DF39137E
                                                                        SHA1:92C46DCD23FCDA7D0D53E1A49F9A4D3E9684D054
                                                                        SHA-256:7EAEBDA0F4C88C43D8DE32202090C3E158F5F25CF8DCEF20A46B4EB0D72CD4BC
                                                                        SHA-512:33DEF0EEAD3FADF32BA0C5DA7E626986B7A928AF2F0CB4D480D1C422737581332D63ACD2795A3BD793916B2A074F809D699D9732D81C23373C2620E76DDFC675
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@.......................................&^..b?..b?..b?....p.y>...[D..?....q."?....w.P?..b?...?....q.E>..E.r..>..|m?.C?...f...>...I..M>..E.r..>..|m?.w?...a...>..|m*..>..y....?..|m?..>...e.`>..y...>?...aD..?..Richb?..........................PE..L......e...........!.....P... ......-".......`.......................................................................m..^...Xd.......p..........................` ...a...............................................`..t............................text....I.......P.................. ..`.rdata.......`.......`.................@.data...P....p.......p..............@...CODE.....$...@...0...0..............@....rsrc........p.......`..............@..@.reloc..>0.......@...p..............@..B........................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\4A15.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):836608
                                                                        Entropy (8bit):7.327697199060668
                                                                        Encrypted:false
                                                                        SSDEEP:12288:cXDnaeBniroOiI/th3XR+sUoZvckY5t9UevKRwGqp3+Yzr+9mpb6NPE/GBuYt:obnQ7Z/DosUMy9vvKRWp3RvOPDBFt
                                                                        MD5:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        SHA1:39B0471E8D501702179BFCB744728C00DCCED7BA
                                                                        SHA-256:635A73433A258FA5A9B3B015F57CA84E1C296E9B65888FB64EBB602213A9D49D
                                                                        SHA-512:A3FC26ACE23B84369A653A508744BB4502B64D4ACF7548EABF4EFE255A4FAAD89CA5D37E5BFE54F2F1EF81061FED95467CC4AA5672429A5F6714959F28BAD1B5
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 56%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L....c\c.............................T............@...........................!.............................................$...d.....!.P...........................................................XB..@............................................text.............................. ..`.data...DL.......>..................@....rsrc...P.....!.....................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\5838081746.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1826208
                                                                        Entropy (8bit):7.978777574746798
                                                                        Encrypted:false
                                                                        SSDEEP:49152:rkQTAVchw7doMe+3u+ZVWpGPUMfN7YFRM1UN5:raVchwhd3uolPpfdcCM5
                                                                        MD5:878FEE717881CD44FBD351816A653142
                                                                        SHA1:8AEFBF1CEFF42F90980CB054BC6AC90089A4F014
                                                                        SHA-256:55BF635BE312162A07A1F07AADA3796DC672C8342BADEC00DD33F5E458AAB456
                                                                        SHA-512:7E21B7BB78D2D6F3391CCF3DFA6D7F87D12E8719506FD80594DB4F431CB0DD15E0C63EBF11FFCB0B66AFBBB16BF5B51EF9BE4B541EFEBF0424C41172E1AF189E
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 17%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..-,q.~,q.~,q.~2#.~?q.~...~+q.~,q.~\q.~2#n~.q.~2#i~.q.~2#{~-q.~Rich,q.~................j.......PE..L...t..P..........#................./.............@..................................;..........................................P....`...P...........r...k..............................................@............................................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@....rsrc....P...`...R... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\9117.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):834048
                                                                        Entropy (8bit):7.336641074786459
                                                                        Encrypted:false
                                                                        SSDEEP:12288:2uiJP6pnnryLxLZqsib0j913Fz6IT+0jMl4NR/V4D+1ywHYkB9bvfsFN6YENikub:Qw1rEPO6zVE0R6Dh2fmNd3Qe
                                                                        MD5:A76B5322D564C06BDD6AE67F4A8E8C68
                                                                        SHA1:654635560B110AF17AF2F96F3EBEAF7DA4011EC2
                                                                        SHA-256:B89E10AF651DAD9BF02743FBF51A25C0FC6E6CAF6D12CB6BD9692A90C2AE8236
                                                                        SHA-512:2CEFF589DA8FDAABB81C427D9B138BD591CB55AEFF5A05D86EC5DFC12B9EAE932F1A9C5CB5081B25CC050542D37362B9798B4FEB8C240C753C959EBEA76BFAE6
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L......c.............................T............@...........................!......^......................................4...d.....!..............................................................B..@............................................text.............................. ..`.data...$L.......>..................@....rsrc.........!.....................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\9315.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:modified
                                                                        Size (bytes):1129472
                                                                        Entropy (8bit):7.944446605349689
                                                                        Encrypted:false
                                                                        SSDEEP:24576:uyUc+vHwIzwnD32VrvufKTiLSsR/Ihw4gJA/aeUy94:9UcSQQwnD34uCGLBIhmQMC
                                                                        MD5:11498B9383F1DF6E4FA6BBE565F7C85B
                                                                        SHA1:DBF7C8D4607D670D0ECB907613C6ED70361FCB8F
                                                                        SHA-256:644A5185DC1B4E7115491D298C206E49A9DBA3A88B0BDD48D86ABD7572B744BB
                                                                        SHA-512:1CF5F949C1EF344E0A1ABC12441679EDB128E8F05766D5DF60E8E69A614DEF48E4F6D1F6EA91D0AB22A03E5C1B81BC16A2AE39EAA9456295313F5E0268346131
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@.......................................@...... .....................................................................T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................|..............@..@.reloc...............2..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\A388.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):244736
                                                                        Entropy (8bit):6.360730489849086
                                                                        Encrypted:false
                                                                        SSDEEP:6144:dMcz8EQnRrxT5t9kFIndDK4lY4xohYA1au77C0G:dM7XnPz9uIgGLxoSA06
                                                                        MD5:3240F8928A130BB155571570C563200A
                                                                        SHA1:AA621DDDE551F7E0DBEED157AB1EAC3F1906F493
                                                                        SHA-256:A12C63A33382720B5CE010CC050106C3909316477B956CA8C17F4A1F6CA6AA42
                                                                        SHA-512:E7C357E54B7768F1A66E0DABE2C604AFE3765EB858F8B4E5751659A4B373B10FB6CC1DC72641AABF83E34D097F28FA70A78482310ECD93E9AA0347378BDE409B
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 70%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...O...O.......E..............].......L...O...-......._.......E...............N.......N...RichO...........PE..d......e.........."....".8...........r.........@..........................................`.....................................................(...............h....................Q..............................PP..@............P...............................text...07.......8.................. ..`.rdata...A...P...B...<..............@..@.data...P)...........~..............@....pdata..h........ ..................@..@_RDATA..\...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\BB52.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6856192
                                                                        Entropy (8bit):7.973109488958462
                                                                        Encrypted:false
                                                                        SSDEEP:98304:/Ig6vsX5qedOzgVhEFN7iyxGP3zH8nDbsoYbor/gDbHGWluK6Tb7L1vfo:/b5/d7ELU/D83slba/ibHTluKST1no
                                                                        MD5:D5345B2A5D6B34670005F5C3B574371F
                                                                        SHA1:33A8B62B3B384BEF6B6646AB4D154B7E37CE2727
                                                                        SHA-256:4B77EEABC30512A512339603A46914B3060A3447DD3C53743BD2CC03C21F2229
                                                                        SHA-512:24B13562DFC3E486E15F6C50CCB3B3ECBAABB733759E134C6031334BE8B177431F17491D3477803355EDE23A59E54902FFC102310C225CB3BEB824197ADE8025
                                                                        Malicious:true
                                                                        Yara Hits:
                                                                        • Rule: MALWARE_Win_DLInjector04, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Temp\BB52.exe, Author: ditekSHen
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 78%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e..................h...........h.. ....h...@.. ........................i...........@.................................p.h.K.....h.......................h...................................................... ............... ..H............text....h.. ....h................. ..`.rsrc.........h.......h.............@..@.reloc........h.......h.............@..B..................h.....H........h..............(...th..........................................0.._.......~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.(....,..(....~....,.~.... ....Z(....~....,.r...pr...p.(....&..8....~.....o.....~.....o.....~.....o.....~.....o.......(......~....,...(......~....r...p(....,.(....r...po......(......+)~....r1..p(....,...(....r...po....(..........(....(..........(.......(......X..~....o....?....~....&*..0../........s.....s.......s.......o.......,

                                                                        C:\Users\user\AppData\Local\Temp\D8E5.exe

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3209984
                                                                        Entropy (8bit):6.332725013720404
                                                                        Encrypted:false
                                                                        SSDEEP:49152:CWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYt:utLutqgwh4NYxtJpkxhGj333Ti
                                                                        MD5:5B1D2E9056C5F18324FA9DD4041B5463
                                                                        SHA1:64A703559E8D67514181F5449A1493ADE67227AF
                                                                        SHA-256:DDA18B38700CA62172BA3BD0D2D3B3B0DD43E91FDB67B2B8E24044046FF17769
                                                                        SHA-512:961183656C2E0ED1F01EC937E01C5023B9AEA5A9922AA9170735895A3A1E4BBE2B7DE89F16F8C7DF231B145975D103A02DEBF2F24B07DAF0B90C341FE070A324
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 30%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.....w.1...@......@....................-.......-..9....................0..)...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

                                                                        C:\Users\user\AppData\Local\Temp\is-N0LK6.tmp\_isetup\_setup64.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6144
                                                                        Entropy (8bit):4.720366600008286
                                                                        Encrypted:false
                                                                        SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                        MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                        SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                        SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                        SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                        Malicious:false
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1062400
                                                                        Entropy (8bit):5.4815484240015175
                                                                        Encrypted:false
                                                                        SSDEEP:24576:XQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafM8yx9k0:J02rPD37zzH2A6SBIfNafMlB
                                                                        MD5:83827C13D95750C766E5BD293469A7F8
                                                                        SHA1:D21B45E9C672D0F85B8B451EE0E824567BB23F91
                                                                        SHA-256:8BD7E6B4A6BE9F3887AC6439E97D3D3C8AAA27211D02ECBD925AB1DF39AFE7AE
                                                                        SHA-512:CDBDD93FC637772B12BDEDB59C4FB72A291DA61E8C6B0061AD2F9448E8C949543F003646B1F5CE3E1E3AEBC12DE27409DDD76D3874B8F4F098163A1FF328B6F0
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 6%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0............@......@...............................&.......f...................0............................... ......................................................CODE....$........................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls.....................................rdata....... ......................@..P.reloc......0......................@..P.rsrc....f.......h..................@..P.....................f..............@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\TtG5py94KsXzXSkP3RqVlzUB.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\WFFvQ6jG19CAfRXHNIBf2RrT.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\WQ1sXS4A8SPQ3OH5qUwmsfK7.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 78%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Wuwrf4eUOpvmHyFvQ2XCPgVU.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\X4G1qMGsevrGDCsTxtK3q3TA.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 70%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\X91wRWDPO4snjUjOgZjUlicT.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 47%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\bowsakkdestx.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:JSON data
                                                                        Category:dropped
                                                                        Size (bytes):559
                                                                        Entropy (8bit):6.004259360523156
                                                                        Encrypted:false
                                                                        SSDEEP:12:YGJ68UMQMuFhwufi+Cv2OHbW2/lBtrYrHw0J/6X+yN55z:YgJURMChni1v2OHbWGls6X+yzh
                                                                        MD5:E085EE40110A62687426D9912F76BA0A
                                                                        SHA1:570129022D1257B25E4E41179B1FCE484E35E173
                                                                        SHA-256:249D09D2B2F601F13AEC42E8C656C5612F0400477C724CB6E8A6D26EEC845D57
                                                                        SHA-512:F3088B4637A73FF917318930CB9F69FA7CF9ACB2924E8A001C20A502461DED42A2BE035BF16792274A2F5486539544CFE2C1EE1A997623788545195CAB7ACD4F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz6fKeRUzAuT51Jzl25x1\\n6rIH8kP+Za9iV6o7RJzhAukJBNh9iYpD3z0BRtUYY7G4lSqjMRJHR1eReiKKJE5D\\nwyflo\/4NUlBJ5QA4zFAamyP3ajU0BVX3dse65p5r7K7wALsdMLsXg+x8YRkQSBVr\\nQPROSOgYJZmDe+9g5QdWb40\/vPP+oKyceFvfPiWyf6tzEwOzihxGQDJ1ZghRh3Si\\nFMLoHm8blxwJ3u3xq6lhIsaZNJ1aX\/RbynaXSz6NU3VpFSgC00CoYAYPHcVY6aWe\\nj+iMeY\/mLAYeK\/rE8JZxbksETfAU3HEiN7S7k6clRlzwmkVfSwE6epDUR4dzTQUF\\nYQIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT"}

                                                                        C:\Users\user\AppData\Local\c8KXUlVEBLWKm0FvrBR7FzOQ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 71%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\cDbEZELclwHIblfubBb7q5VJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768503238619159
                                                                        Encrypted:false
                                                                        SSDEEP:49152:5+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4va:kwrGHip8nfzyeJaipzW88gLva
                                                                        MD5:F5DA6EBF1248A64E02DA6C513A22929A
                                                                        SHA1:DE5379E44DF789AF6AC843416A7A7436CF9EF499
                                                                        SHA-256:32C570DEE9893BC6DFE99FF86EC73B1AD942F67AD14F8EE44298280CE77B25B9
                                                                        SHA-512:918ADD37161E2080FFF2DFA0C13EE02BCD2CAEBF526970A60CD592E4F251F7122C719E34B61A69A5731DEE62ED75C0742E0D13FD4CE21FBD9E92B338983888E5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS.......-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\AppData\Local\cIYKpG6eQ8E5shW60pciCDk9.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 35%
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\AppData\Local\cS0SutwWZwoWvtpaGLPFoC2y.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):836608
                                                                        Entropy (8bit):7.327697199060668
                                                                        Encrypted:false
                                                                        SSDEEP:12288:cXDnaeBniroOiI/th3XR+sUoZvckY5t9UevKRwGqp3+Yzr+9mpb6NPE/GBuYt:obnQ7Z/DosUMy9vvKRWp3RvOPDBFt
                                                                        MD5:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        SHA1:39B0471E8D501702179BFCB744728C00DCCED7BA
                                                                        SHA-256:635A73433A258FA5A9B3B015F57CA84E1C296E9B65888FB64EBB602213A9D49D
                                                                        SHA-512:A3FC26ACE23B84369A653A508744BB4502B64D4ACF7548EABF4EFE255A4FAAD89CA5D37E5BFE54F2F1EF81061FED95467CC4AA5672429A5F6714959F28BAD1B5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L....c\c.............................T............@...........................!.............................................$...d.....!.P...........................................................XB..@............................................text.............................. ..`.data...DL.......>..................@....rsrc...P.....!.....................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\d4dL2ywdYIMevGjO45NXflQu.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\dBv3dMkRlgVVDPZTZMyWgdJN.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\eKHEatA2YHjGupA41pjTqd4Q.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\ekOUFFIwIeDOzbw9eNWrMi30.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\en2Jyn1qg7jEGhbzerb4PGCA.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\AppData\Local\ex3hWoysxxQp9yfxr1vhsCEu.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\fwfQo65WjnmzC07yXHDaETw8.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\gFd0eLtQK8YMDxXc1BQkGeep.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\gIwaldePRmh9KRuICLUyfpks.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\gdGlSTAHRx5XYnptuFFvfF3Y.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.7685046761933085
                                                                        Encrypted:false
                                                                        SSDEEP:49152:i+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vr:1wrGHip8nfzyeJaipzW88gLvr
                                                                        MD5:78FC8307D52820455467A39DE937A290
                                                                        SHA1:2ED136E0ECC5A5932F5DD2D590ABCA5A9FDC58C9
                                                                        SHA-256:77903CEAA56B058B232D6AA206ED08E6326C63FFB0DEF5FC5E0EF52DC7C9D657
                                                                        SHA-512:654D50EFBC8399B3620250FE85855533A6A9700C3C51D63036D760577DC3185A1B641AEB3A2B79C078353211813541687CD0A2ACA43BC96FC6F2F8CAB01138B8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......5-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\AppData\Local\hduocco6pWLP0HaA9bgAhije.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\hypYBFCjte80ItmGLKdfXKZ2.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768505745291893
                                                                        Encrypted:false
                                                                        SSDEEP:49152:n+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vT:+wrGHip8nfzyeJaipzW88gLvT
                                                                        MD5:2A5485871D21C57833C57807B59A6B18
                                                                        SHA1:255228C692227894F61349ABDCE5851818D0B15E
                                                                        SHA-256:90E8C59057DBA0DFF3979489AB59C2F67ED50CE204CA61FE13142B75C4EDDE1D
                                                                        SHA-512:CF3ECACC783CE393870B78ACB1B1398ED077423341975933ECE6E62FAF3795F334606055D428B22CD4BC1D30B7831DD2BB290C73F9C7CD10BFDD5016B8D91243
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......A-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\AppData\Local\iCCTvyp70q0GmXWM7T6SbAw3.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\iPhp3cV97VGJ34Ref6E2pORE.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\jkJntnUiFKCYlUk0tBLKBOQE.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\kCzd2hvmIWrMuzzglfLDz5jN.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\lCgtZ6E4HkEVDH0ClzJMZwZY.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\lWqXWTOTj5tqRWB7LrSzEOfi.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\mGx41hPeYElMLjZ4bbI9SOQq.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\mdVqxBv1FXzpT51i7izhV1L3.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\ndfd6Kq0UsE3T3ImvDCKwi8c.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\nlZXac1d8FE86X98ibImDWvF.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\opugKRO9HQIQrHGr6X89OLro.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\AppData\Local\pAN917faLxSCNhjrt1Tur9pL.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\qdXZz0xbr8NxLE1KImKm0Ewp.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\r7udPMXlAvzgwc1HpIoaUJHs.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\rOWY7QA6HmKaReenlQLKGBVq.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\AppData\Local\rr6NwVvTBpBRblqk6A4rLRgU.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\sPCxEY41osSQyAztFqDas2bV.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\t0EOMhSnTVCOCZS9qZwimCQw.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\t1VMdyrwrvacSZR05WqVdNos.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\tIomxm3YzHufqxsKHNVvwAcF.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\AppData\Local\tJU5p8ys1whXWo8BDeT3nnmx.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\uGG02PvwRtGMBgiPW7q8rUhy.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\AppData\Local\uHshgHc7dTYJxuLdXX1zGE4V.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\uYMXNl5sSvaZoW3VwBNxI0U7.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\AppData\Local\ucUNYHpQm0C7pIii4CUfIP8Y.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\yRbowIjZdxellWMLi8kEb6gJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\yegJdMAIBcksHIcEa37Hzz4U.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\AppData\Local\z2jspOJECx7C1xJp0mXk8tDq.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\zDIXJhMuVzNtJxExlDXABWMh.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\zUUHNzh5T8q1lb1rXsANRm0p.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\AppData\Local\zXDbhoHyWUFQr5mr9s8YwHsD.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseService.exe (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):10453760
                                                                        Entropy (8bit):6.161764051199235
                                                                        Encrypted:false
                                                                        SSDEEP:196608:X7JSz+ZqKAXKbehKGCL4wvAh1qPXf4FpwIeMu9:trwXKbehKGCL4wvAh1CIs
                                                                        MD5:93EE86CC086263A367933D1811AC66AA
                                                                        SHA1:73C2D6CE5DD23501CC6F7BB64B08304F930D443D
                                                                        SHA-256:4DE2F896FF1FF1C64D813CAD08B92C633BE586141D2D5C24099AE2AE4194BECE
                                                                        SHA-512:D980E01E3F6A262016F3335A2D127F6EFA6A73FE166F4F36355E439CBB2098D624E63ECD0EE8BE8575B3AEEFB0B1E9BC8E0552D65C4E611BFF9F7F119C186C5A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........X........"...... K..P.......U........@......................................!....`... .............................................. ..|....................Z...)...0..tq......................................................@............................text.....K...... K................. ..`.rdata...hM..0K..jM..&K.............@..@.data....y.......P..................@....idata..|.... ......................@....reloc..tq...0...r.................@..B.symtab..............X.................B................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseUpdate.exe (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4906752
                                                                        Entropy (8bit):6.2122239347228705
                                                                        Encrypted:false
                                                                        SSDEEP:49152:poHH3a5rb/T8vO90dL3BmAFd4A64nsfJYesE3Q1AXE9mwkE3jw0ppWMfpihtrCx3:G316A9mwL/xY1Y2LXEG144O
                                                                        MD5:8179EA58059B7CD510EDF75678E880FF
                                                                        SHA1:59343A2AE1D0A3A2F4BA27048246D25B5FAA608F
                                                                        SHA-256:E3E50F5B32989EC3F8A18ED254D2E1E4DAD0AE9DB5EB09E5AF88BDA99C7B9AB1
                                                                        SHA-512:354E0D5CFCFE801CF79F08615AF67A0C2D164234B51C007CEAFC5FA5F312F3E8F0C422F1E15CF5AF54F7950B9BBDB1923C14E766019A5F3E80BBE5D281F841C8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........J......."......<$..........@........@...............................P.....$.K...`... ..............................................@P.|.....................J..)...PP.......................................................F.@............................text....:$......<$................. ..`.rdata.. ("..P$..*"..B$.............@..@.data...(.....F......lF.............@....idata..|....@P...... J.............@....reloc.......PP......&J.............@..B.symtab.......P.......J................B................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\is-0SIDM.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4906752
                                                                        Entropy (8bit):6.2122239347228705
                                                                        Encrypted:false
                                                                        SSDEEP:49152:poHH3a5rb/T8vO90dL3BmAFd4A64nsfJYesE3Q1AXE9mwkE3jw0ppWMfpihtrCx3:G316A9mwL/xY1Y2LXEG144O
                                                                        MD5:8179EA58059B7CD510EDF75678E880FF
                                                                        SHA1:59343A2AE1D0A3A2F4BA27048246D25B5FAA608F
                                                                        SHA-256:E3E50F5B32989EC3F8A18ED254D2E1E4DAD0AE9DB5EB09E5AF88BDA99C7B9AB1
                                                                        SHA-512:354E0D5CFCFE801CF79F08615AF67A0C2D164234B51C007CEAFC5FA5F312F3E8F0C422F1E15CF5AF54F7950B9BBDB1923C14E766019A5F3E80BBE5D281F841C8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........J......."......<$..........@........@...............................P.....$.K...`... ..............................................@P.|.....................J..)...PP.......................................................F.@............................text....:$......<$................. ..`.rdata.. ("..P$..*"..B$.............@..@.data...(.....F......lF.............@....idata..|....@P...... J.............@....reloc.......PP......&J.............@..B.symtab.......P.......J................B................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\is-KJIQ4.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3209984
                                                                        Entropy (8bit):6.332725013720404
                                                                        Encrypted:false
                                                                        SSDEEP:49152:CWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYt:utLutqgwh4NYxtJpkxhGj333Ti
                                                                        MD5:5B1D2E9056C5F18324FA9DD4041B5463
                                                                        SHA1:64A703559E8D67514181F5449A1493ADE67227AF
                                                                        SHA-256:DDA18B38700CA62172BA3BD0D2D3B3B0DD43E91FDB67B2B8E24044046FF17769
                                                                        SHA-512:961183656C2E0ED1F01EC937E01C5023B9AEA5A9922AA9170735895A3A1E4BBE2B7DE89F16F8C7DF231B145975D103A02DEBF2F24B07DAF0B90C341FE070A324
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.....w.1...@......@....................-.......-..9....................0..)...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\is-V1H4A.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):9
                                                                        Entropy (8bit):1.974937501201927
                                                                        Encrypted:false
                                                                        SSDEEP:3:6LKn:6Wn
                                                                        MD5:07565B9C68A28A25CA9A3200D2B5DE33
                                                                        SHA1:9AF031BB1346ADAF09C1B0525D21153BE34E99D7
                                                                        SHA-256:D916D44A5D1FBF800906DC469467EF36AF45573376D4C4C9933B1458EBCACB14
                                                                        SHA-512:92F0DBC6C8D8A6A923D334E3FD34F315C06EB97214590C99EF01AB7090D3B90C2C3C5685F737B3045BEC11EA3504A98A63A57D0AAE7C9369C99CEC095E92DBB0
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:0.0.16.16

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\is-VGBL0.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):10453760
                                                                        Entropy (8bit):6.161764051199235
                                                                        Encrypted:false
                                                                        SSDEEP:196608:X7JSz+ZqKAXKbehKGCL4wvAh1qPXf4FpwIeMu9:trwXKbehKGCL4wvAh1CIs
                                                                        MD5:93EE86CC086263A367933D1811AC66AA
                                                                        SHA1:73C2D6CE5DD23501CC6F7BB64B08304F930D443D
                                                                        SHA-256:4DE2F896FF1FF1C64D813CAD08B92C633BE586141D2D5C24099AE2AE4194BECE
                                                                        SHA-512:D980E01E3F6A262016F3335A2D127F6EFA6A73FE166F4F36355E439CBB2098D624E63ECD0EE8BE8575B3AEEFB0B1E9BC8E0552D65C4E611BFF9F7F119C186C5A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........X........"...... K..P.......U........@......................................!....`... .............................................. ..|....................Z...)...0..tq......................................................@............................text.....K...... K................. ..`.rdata...hM..0K..jM..&K.............@..@.data....y.......P..................@....idata..|.... ......................@....reloc..tq...0...r.................@..B.symtab..............X.................B................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\unins000.dat

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:InnoSetup Log 64-bit DigitalPulse {64F4736C-6169-4520-9368-BE1C9EAE552A}, version 0x418, 6382 bytes, 960781\37\user\376, C:\Users\user\AppData\Roaming\DigitalPuls
                                                                        Category:dropped
                                                                        Size (bytes):6382
                                                                        Entropy (8bit):3.9450773221852167
                                                                        Encrypted:false
                                                                        SSDEEP:96:Cm1KlQUiGDt/CFK3bcuJlEDA4MZAe2LxCFQCFKCFAuD7HhzZ:Z13g3bP4DSmevHf
                                                                        MD5:66E3AE9AF70B027B0E1CCCD438225CFD
                                                                        SHA1:531F7028A89079FAFF299F7420118FD7CFA99E91
                                                                        SHA-256:C07A9ECC8AC7AC0CACC8834F6F172B8ACB10532735F51A86A7A85CE675745F04
                                                                        SHA-512:99E71514AB9F9967A5D1461678A7CBAAF9BA7CE0CF0C2319314A01EF7E629D0B1BCD04F6362BF9D059F450EBBD0A7A574852B3E02C9D7061A9CC51ED2C8106A0
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Inno Setup Uninstall Log (b) 64-bit.............................{64F4736C-6169-4520-9368-BE1C9EAE552A}..........................................................................................DigitalPulse................................................................................................................................ ...........................................................................................................................8.\...............9.6.0.7.8.1......h.a.r.d.z......C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.D.i.g.i.t.a.l.P.u.l.s.e..................%.$.. .....|....p...IFPS....$........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TSETUPSTEP.......

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\unins000.exe (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3209984
                                                                        Entropy (8bit):6.332725013720404
                                                                        Encrypted:false
                                                                        SSDEEP:49152:CWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYt:utLutqgwh4NYxtJpkxhGj333Ti
                                                                        MD5:5B1D2E9056C5F18324FA9DD4041B5463
                                                                        SHA1:64A703559E8D67514181F5449A1493ADE67227AF
                                                                        SHA-256:DDA18B38700CA62172BA3BD0D2D3B3B0DD43E91FDB67B2B8E24044046FF17769
                                                                        SHA-512:961183656C2E0ED1F01EC937E01C5023B9AEA5A9922AA9170735895A3A1E4BBE2B7DE89F16F8C7DF231B145975D103A02DEBF2F24B07DAF0B90C341FE070A324
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.....w.1...@......@....................-.......-..9....................0..)...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\unins000.msg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:InnoSetup messages, version 6.0.0, 261 messages (UTF-16), Cancel installation
                                                                        Category:dropped
                                                                        Size (bytes):24097
                                                                        Entropy (8bit):3.2749730459064845
                                                                        Encrypted:false
                                                                        SSDEEP:192:b1EjNSCkf3SCqsTr6CCPanAG1tznL7VF+Iqfc51U5YQDztXfbKJG/Bfvo:b1EK6CHr6fSX+7Q1U5YQDztB/B3o
                                                                        MD5:313D0CC5D1A64D2565E35937991775A6
                                                                        SHA1:B8ACB11878C485865C9E4679248E53B83A8F3AD4
                                                                        SHA-256:5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
                                                                        SHA-512:7C2DB4A3A4A8DF09F8119A7BA4CA9EBFE562F0A34D431928344E21A5853931EEFBFD910DC4026C6788AC22423BBB125F2B700326D8A1D82B134E2B486C3D0684
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Inno Setup Messages (6.0.0) (u)......................................]..+..... .C.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

                                                                        C:\Users\user\AppData\Roaming\DigitalPulse\version.txt (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):9
                                                                        Entropy (8bit):1.974937501201927
                                                                        Encrypted:false
                                                                        SSDEEP:3:6LKn:6Wn
                                                                        MD5:07565B9C68A28A25CA9A3200D2B5DE33
                                                                        SHA1:9AF031BB1346ADAF09C1B0525D21153BE34E99D7
                                                                        SHA-256:D916D44A5D1FBF800906DC469467EF36AF45573376D4C4C9933B1458EBCACB14
                                                                        SHA-512:92F0DBC6C8D8A6A923D334E3FD34F315C06EB97214590C99EF01AB7090D3B90C2C3C5685F737B3045BEC11EA3504A98A63A57D0AAE7C9369C99CEC095E92DBB0
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:0.0.16.16

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalPulse\DigitalPulse.lnk

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Sep 24 11:04:38 2023, mtime=Sun Sep 24 11:04:38 2023, atime=Thu Aug 10 19:50:50 2023, length=10453760, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):1051
                                                                        Entropy (8bit):4.928185945299303
                                                                        Encrypted:false
                                                                        SSDEEP:24:8m1Jg5GoXULA6QlF6a6QlBAmKmtI6Qlo6QlttIx6Qlr/dB/3m:8mng5GAkQGQkQtTQBQH/QpVBv
                                                                        MD5:6D2DE999682B722DDE6E5717A0377860
                                                                        SHA1:559BE632EF01ED54B2D1D2704E704E2727FA0C15
                                                                        SHA-256:02C5473D76E11C09CFF179BF39119BE3759B1634EAD39EBA2AE55C2689D27F09
                                                                        SHA-512:0C99AD63163A5A39FF26F97D2890192B332D4AE2AC8FA63B591103030AFD4E2372408F34151C9D134C1CA463FD5599B1A1086B31F97BF3E873D52D0EA2D3814D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:L..................F.... ....W.J.....@.J......VX..............................:..DG..Yr?.D..U..k0.&...&...........-..rJ.p.......L........t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny.8W|`.....Y....................f.(.A.p.p.D.a.t.a...B.V.1.....8W.`..Roaming.@.......Ny.8W.`.....Y.....................`9.R.o.a.m.i.n.g.....b.1.....8W.`..DIGITA~1..J......8W.`8W.`............................3.D.i.g.i.t.a.l.P.u.l.s.e.....|.2......WY. .DIGITA~1.EXE..`......8W.`8W.`....+.........................D.i.g.i.t.a.l.P.u.l.s.e.S.e.r.v.i.c.e...e.x.e.......r...............-.......q...................C:\Users\user\AppData\Roaming\DigitalPulse\DigitalPulseService.exe..3.....\.....\.....\.....\.....\.D.i.g.i.t.a.l.P.u.l.s.e.\.D.i.g.i.t.a.l.P.u.l.s.e.S.e.r.v.i.c.e...e.x.e.+.C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.D.i.g.i.t.a.l.P.u.l.s.e.`.......X.......960781...........!a..%.H.VZAj....T.7........-..!a..%.H.VZAj....T.7........-.E.......9...1SPS..mD..

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0Lfhv80yjQqPZSzTm3yFdWPF.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):90
                                                                        Entropy (8bit):5.042923896397362
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5NcpmXMO48ClIkdan:fE1WXp+N230uMf8CSD
                                                                        MD5:855D1F05E860DB0A57184ED902900339
                                                                        SHA1:220339827FF72384512BD03FC3AD7F1B8C6BD0AA
                                                                        SHA-256:95EF50B5E4E5141E9E623C07366891198DA17306E6DD807E7E9F8CB40BEC1DCE
                                                                        SHA-512:335E485181A8DACA596190B5CFA4BC094552B5FF1EDBD8173390830FAA700FBC337D9E8D89F3C8398299A90BEFE8136769F760E17B0F60133193032DDD9460B4
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\hypYBFCjte80ItmGLKdfXKZ2.exe" --silent --allusers=0

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0bUmj41QzTFKxcsKeTSfKkOO.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.98318039168042
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5LCYAb0dm:fE1WXp+N23Sb0s
                                                                        MD5:2F9E4CDBC66ED088737112B40C95A7CB
                                                                        SHA1:776F5EC4D755346F93509AA256402CE43912CB67
                                                                        SHA-256:784E0149AD36A5D48A3CF390F3DBEBB6ACA720855F8A278B42151978ECA5FC78
                                                                        SHA-512:5A71DD6B56DD00786DF7549755F3187D5690D49F0D8AE0179E6E304444BD081921EE2829049D6BCF1020B1FD78F9F3D537961158D3B2459CBC1075D64856841A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\nlZXac1d8FE86X98ibImDWvF.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vrHkwSzKoIdyE31xmdhdzW9.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.911374327298056
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5PUwFJwOVGPFm:fE1WXp+N23XJKFm
                                                                        MD5:B856596B1547C5AE957DC4F20EACFF0E
                                                                        SHA1:8FDE51DCA9EA05ACBA3AD5FF6F13FF2D8DEA10ED
                                                                        SHA-256:E10890399F3FA1747E6E506696AE0754B172F6232A5F40F010D9EEBF56C91C7D
                                                                        SHA-512:CA34923DB56E06EF06F978A2B9438E6D84EE1F2C319A28464413EFAB548100DB0FAD1580275AD76F710B854ADB90FBA70F845E23F54BF5BB581EB23FD0157248
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\jkJntnUiFKCYlUk0tBLKBOQE.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Q4EkPjCkxeFEQ1Eatt9Dwxh.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.382012028057221
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5nAr/ySflKiyfsj2o2DCisF:fE1WXp+N23fSIiyfsjP2DPsF
                                                                        MD5:64DA400734E8132141EBB7E7433825C3
                                                                        SHA1:D21942EC71AF59847857CB0BB9951EA9AE7499CA
                                                                        SHA-256:59C45579C6FEFF413532C4D679A677CBCD85F0CC3AA9E16CCDD84EFCEF72B7C1
                                                                        SHA-512:33B8992FF7434ADB5F89FB30B706B067F56A84631D226A5AFFD002EC03795810365E83788E76317F9639DE4CC393370A882D9638231BD22BC2C5E1D492C1B796
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\BYpvSgsqBQF2e9VWX5DwhO9b.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4DG0XAULkG4rtQXtfX3kCH5m.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.720863500809263
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5VkI0FFcDLNHF:fE1WXp+N231Qm9l
                                                                        MD5:FD79DD6749DCA2DB54C75B0913E94516
                                                                        SHA1:422962D2A0DFF08143A0B4D001A549F16CC87BE0
                                                                        SHA-256:6A0DF5C359100CBE5D33ED1D1A6789C73C6D6C0077CEC8322F9F290DC82C61E9
                                                                        SHA-512:41C49588E38E5328165CADEAA0CE2A96B5872EC16EBA88311320B20D670AB3B7CE13735DB390F106F59E00368BD6ECC830340B2F5E42D2EA65E17062122A3F20
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\pAN917faLxSCNhjrt1Tur9pL.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5FHiG1jFHMv7GsPhOUzodwEo.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.870001095815833
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5fpKtDWva8cm:fE1WXp+N23ctDWv3cm
                                                                        MD5:C1A4EB47D6BB4E88D605B6308B7A5F1C
                                                                        SHA1:3FD1A5F459AC0FD661367A657302112BFA9495E5
                                                                        SHA-256:A268B877BD2DDF04CE149F4B7293F9D7818857D19C0A17B4A32F99158B9945DA
                                                                        SHA-512:C61688F9F938653FF135222ADDE9A5C2AEFB3664820420A81714C408AB130D303EA90FB860FF0BBA154D0E8D308F0C25EB9F38639E0BFAF501B6895BEC46DEB2
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\zXDbhoHyWUFQr5mr9s8YwHsD.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\62l33e7HUe40sAbIBogbEpmM.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):90
                                                                        Entropy (8bit):5.1697006689997735
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J52CogeTtR70Eykdan:fE1WXp+N232FPxR70EyD
                                                                        MD5:CA9DDD6A9310EE11BE60674D78B9455E
                                                                        SHA1:E779256D1545318637C485C24EBEEDE75F7DCC5D
                                                                        SHA-256:FFA52C24CA770D30EF4C695FC72F5AC16D5F81929139FF14FA3EFC8376DD1612
                                                                        SHA-512:D5F5E5BE7986B0626D629280AB5E20AA45ADE3D90B65F9101FC1D2BA848D5CC3C1E4DF1EDF3896139DB9114FAC247E5254EDC5117D059DC52EB51459C7075308
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\SVKcZYT3TwUPvLXOcZVQMjWE.exe" --silent --allusers=0

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\745tzE4k357KTJX9XrGihSFX.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.876731435623227
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5VJ3H8vuTDan:fE1WXp+N23jlDa
                                                                        MD5:C402B83B5ED8C6579B55606D23973A65
                                                                        SHA1:90CA9440692548F6CA9325BF19441549C59949EF
                                                                        SHA-256:89E4EB9C203CBAB13A90799D60405C31F203E7F9C8FEC129B7350EC73A9A3F81
                                                                        SHA-512:14C9F76EB34C6D235B7B4601F0A7F43BC795C098337214BE17FEF26B186DDD5F64A95520B83A790861D426C3E3E2638F6F3A61A9DB68B5973936D67319FDFA98
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\0lRbbbWcsJKvfly5UKkRLgWl.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7LUSH97ozicm8oSAzFzv30fB.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.974628355944436
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5iK/Gy0CHF:fE1WXp+N23ikGyJl
                                                                        MD5:811630FED89C1A64374FDADBD44DF9CF
                                                                        SHA1:5CBD388F32CE8E3013B31BE525F3F3866EDC4409
                                                                        SHA-256:95B5056303766560902C27769EDE2068AEB5B1D231B805440E4E5436665645AC
                                                                        SHA-512:32F8ABD44A37286695782CB2A8AFCB4C490D9D71A1C023513BEAEC7234A7AACE46A7431E89CAE549AF40EBC6D5E5FB4EF7477364AE82AFC0C456B08ED517830F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\G2DNcZFdbZ5vEmNAUVLs9Ohf.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATKKHBDhrRJwctnRcnUm6Pcg.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.963687957362356
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5RLI1o2B1CCln:fE1WXp+N23tGh
                                                                        MD5:EFCD320119E30C5EF0101229880D2ED6
                                                                        SHA1:AD0BD264CAA67CB9B3991C85B60F26B3DD61DFBB
                                                                        SHA-256:FE83B5CC88FBD1029E55227423D6A8544221F5D61C3354D416D9308283DDC306
                                                                        SHA-512:C1CFF6E3D305AEC144137ACD11EF9E7D4D2B53DEFCAF9310FD7B3BB9EA119B279355EAC4189F325AAE9AD5EBB5016FA32DE44522F707999C5A8AB829EAEF797F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\4nmbyTUdyzoQS5v44sOkHxgO.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Aflaw6AZSGKIe0s45Bz4rgPm.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):71
                                                                        Entropy (8bit):4.873643472545135
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5cfP6ezNHFKWn:fE1WXp+N23cfiezSW
                                                                        MD5:E4CAB3DD7D16D74AE918FE52D9F19B8A
                                                                        SHA1:A74C99166DA02891D7A96D58FF2708621A38ACBF
                                                                        SHA-256:0A299CF372A9B94105CEF5011A619CB030CBB4DF4E8060E15A50F984D807101A
                                                                        SHA-512:A9AC3740327ECA64301C029007ABE5CFA440BC2F115F580FC07EFFAD145B0117788EF8B74F5A6F1ECBFBE866F840AB4238CB013398E01B596B0D559B7E1CD7AC
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\9rjyJ5VsLUcAN5cWEKCTLeAn.exe" /s

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIDZnNdiQJAaINi14fIkmT0h.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.057749189183704
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Mm14VMsV2HbMAdiF:fE1WXp+N23Mm1LsV27M4iF
                                                                        MD5:4F8DC3F594E33B748D3FE5BE1F2F386B
                                                                        SHA1:6621739C3684D677336E4981C1D267DD38E9C80F
                                                                        SHA-256:168046C37D7329AF9A034B14B4B8DD6F9AE4FD7007070C50163D9C9F10541A98
                                                                        SHA-512:3BBA72A4299C23A185688F532748F9A710931FD7461DEE60DC7A2473EB0A98E84EC154F1D37739A3F075D341B0BA704B0CF2E73277FE3AD968A90B99B6A2E816
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\iCCTvyp70q0GmXWM7T6SbAw3.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cnjktv5SHVaWkmg93IvmjT0w.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.893329218633758
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5O14QffIWNl:fE1WXp+N23OfNl
                                                                        MD5:B6683CC284F02949C2FC17F76A434C60
                                                                        SHA1:27AEC576165A17A4B2AB4EB66A9499BBA9EE9A3B
                                                                        SHA-256:1FB7A6C9467F09B67409008437D744CACDCCBF2B660133AF302E0510E989F077
                                                                        SHA-512:BFBD2446B27B3D286B6686304BA4CF95B13F76A9975D38588CE35EC21188E8CF8709942D9D3408E8E605EFD529EDC42A991151ADD8E72A1930A328E55CD09A02
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\kCzd2hvmIWrMuzzglfLDz5jN.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DZNdMDc7jqkeF9bqdtQef9yM.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.9237620515339
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5SDo86v:fE1WXp+N23S4v
                                                                        MD5:730984FCE027E36AEE67B95C58A8FD24
                                                                        SHA1:E927922D7F280CD5D97C501BEACB080D472C82AD
                                                                        SHA-256:4F2096ADA9267CC2B2BC6DDE803FCAE44340CDEB245A0A88F2840989059F984B
                                                                        SHA-512:A6BE5971B5360F74C2421054C95172BD4C1D7FC1A8264AA58546B1FF6C2418B2A7634E9DAEECD03C1759BD3781B9E51CBDC71F7E5855B02460E62DA0D575A1B6
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\7BzwsLUKsvJRsr2MzRqYN9bI.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DdEpoZZi4YOh4OnfrVdHElZb.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.865791037041148
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5qBcQwmRhPqp0Uy0dAl:fE1WXp+N23q0mOp0rJl
                                                                        MD5:A95C85A898E07229F363695832B6B0F5
                                                                        SHA1:19EDE215FDD1CD0BE63954BDC8C54EDA3B97C724
                                                                        SHA-256:06BAF652FFD2D8043555329D3763E849736B11EA15A8C63EC88803E0E4C0E452
                                                                        SHA-512:39B30A75D19AD220E2B7870607C128AFFFEA6CFF9D100631ABA1A438B5F03F553A7F694647022CA4F175705559EAC60C3EE2F72EE0F3EEBB9ADEE36603F1BFD0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\OdBy5UCgwCs2zOQ5hgwqYDDW.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E7Idc4Rv0o4k8F06OBpETIIR.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):90
                                                                        Entropy (8bit):5.019592057840586
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5GRdewHQzvkmIkdan:fE1WXp+N23GRg0Y8D
                                                                        MD5:A537C6B7BF5429505F73D20AE43B4650
                                                                        SHA1:D5F4179624C268027808156811316F05B9A4C883
                                                                        SHA-256:F0C389C7B5453A0647C812DB4F9A30DBAA669BCCA806F0F901624BC70B0CE12D
                                                                        SHA-512:94F3DE71F5EE9F461E55C2FEA9C1BA83873104564DCD51C61923430E74DB8D402F97B1BAEF20AAAD6C0DB579246E7BA70415B0A75344ED81686D775B9F907157
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\cDbEZELclwHIblfubBb7q5VJ.exe" --silent --allusers=0

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EqPIdUUlTMy5tQLkxM9fn0Ae.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):90
                                                                        Entropy (8bit):5.0366543528771395
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5CBjihL72H4dmIkdan:fE1WXp+N23CNae4D
                                                                        MD5:EAC1ADA8022338A6D50BFC7B4FAA63AD
                                                                        SHA1:142C8953171CF2E663FC599293F9B52366D15A08
                                                                        SHA-256:23F4176895398957456D85CA5510EF7E71C0DF08A83BCD481F793A38D386A528
                                                                        SHA-512:EEA596C6B5AD4AC7938A3057919D13A45F5A3599F330DAFE1E8853CC1301969D9F96B6C07ECB0B77427A1F29D7E278E85DB14F1BB3F3D1823ABA94FD7E379430
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\gdGlSTAHRx5XYnptuFFvfF3Y.exe" --silent --allusers=0

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\F0wBxbY5f5DKwVnQVeO4owaC.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.883836145705445
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5hjgkjgMUFn:fE1WXp+N231gagt
                                                                        MD5:9475C073EDF08D0DEC58BC8B2EBE17C1
                                                                        SHA1:82FBBBDE61F2F03995CADC255E93222DFEC7912C
                                                                        SHA-256:46701344D2D77658802156DECD6D633D357D455D6C38562F2CAAE97C3E509B64
                                                                        SHA-512:E36D123BAE84A4523D6DDEC9247770BC7A291F58B862ABB0F738F09DBBA89A30824000A3AB23E85C5A1E4A8FD416DBE7D68A14FB4C90C6DF0992F47CF9B5598E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\DFhwCIhHEDQ5pEOtcRuwyHkl.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FVSZ5f8OUEP7i1ry4oDQSxqU.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.985568754526515
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5ocp1km:fE1WXp+N23oCJ
                                                                        MD5:B09180EF4E941BA1E4E039B8A4462FA7
                                                                        SHA1:08159CCF5AC998BE7E261BC5ABEEA9DEF7318688
                                                                        SHA-256:AE02046598A9E2459A8C87B2BF0F4D1B5FAEC7BF45CC70901E01CD58D077280E
                                                                        SHA-512:0F83C7269959CD0DFE4951D5D7A4FCCFB3499EEB6E3CAE22E77C7474CB364501E674D52ABD7927003D54A4AD77EFA9368A49889DBF0E91761780B5567814CBA7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\Mrqt0LPomy7YxUAwjV5w1C4Z.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FjkoyI2B9AB48Ezj9TYV0Ahw.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.916657341451682
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Gd9omChOcLAdiF:fE1WXp+N23Gd9oMEF
                                                                        MD5:7640589368FB11E28DFAC9301F29E676
                                                                        SHA1:3E15C29E7FEB416A32660A1C55444A10044B4929
                                                                        SHA-256:5EC8DB73D4250EB6D3B0BDF6DEFE68CC5939EEFCF85232A5F9142C35E2221786
                                                                        SHA-512:5706519681465E7826A54F096C9313F113DD82179B944276546DBE669F2372FB8E565C4A22B180F0DA30CF345901C6BAA58F25EF7038B513F69DA88D603BBF42
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\cIYKpG6eQ8E5shW60pciCDk9.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JWy61aGHvYMDcW2BYZLaPgOc.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.8439102398769895
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5GKSyq2Zkm:fE1WXp+N23GJyq3m
                                                                        MD5:AB262DBF2D8B9E52FA345227D1896F6C
                                                                        SHA1:3C3E32923D81E0F0366BFCA9AEA95188BF216E9B
                                                                        SHA-256:3F6C5C74E28DFEEAFBBE0336D65F76C5A571E4E64243A63EA939F4647C0A0A75
                                                                        SHA-512:27D9848A3A2D5802C222242AC7308D65DDAC70ABA71C10E0CB63D1DC3231F66A7F08B3C36B6812A9EC04D00928CE26EF4650A1AC3158363232E8010D45FAC691
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\cS0SutwWZwoWvtpaGLPFoC2y.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Jg7MBx8Eimj9jzWN7SGXgCPJ.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.050644479101487
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5XgA4QcbJHFn:fE1WXp+N23QAzcNF
                                                                        MD5:F305627658C6C0132D7E5200ECFBA9C7
                                                                        SHA1:F6B9E45D820C0369537DB7C87A05D575CCB0F126
                                                                        SHA-256:353DDB23C54893B91DB485079F7EC76218742016421A10DA90A48371BA460D31
                                                                        SHA-512:A6A90EBBA01CAE600A0AB3D379C1783EBC07AFDAAF25154D763C2C38B450536164831694FC2A60970C7B2C269495B7134A2A32CD5B70A8D92594F87CFED4B2EA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\2lVdyQwPNGbHgZp4B3rD4Yqg.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K0dzfudLJ4R9jr53jDBveT1d.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.3465572563031305
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5WASlEd6fdAlKiyfsj2o2DCisF:fE1WXp+N23WASla6friyfsjP2DPsF
                                                                        MD5:783355BAB8DC422BCA74D5482ECA74BD
                                                                        SHA1:385936F794EB765D1477A607D8A022390A3AB503
                                                                        SHA-256:423AB6A87C04F050EBF2CAEB33CA1891053BFD4A0A4A68C12638EFD3D0A858E4
                                                                        SHA-512:E29532FAD55CE9DFFFF837A63B5792EDCD3C3D5AD0F2FC612CBD5E3B97C376F436692DBE352C04049A4C610F4B68C4FE9DEB685DF350169C67AA91D0ED8FB45B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\3e7TFXuOpvanKkAtgXUBsjg5.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KTEYXtNqiWcY5UFNzSqYDslr.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):90
                                                                        Entropy (8bit):5.022067819246408
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5oy8Vgb/kdan:fE1WXp+N23oy8V2D
                                                                        MD5:3AA495DFAAF720FCE4A2DB95846E58FA
                                                                        SHA1:D1F62F3B0488C82C77F691DF3E73AFFBDF8E546D
                                                                        SHA-256:ED9D38A727AEF9E3A8C76FFD4F52D5BC42AC0C3FB860B6C037027548802A10A3
                                                                        SHA-512:67E7AD106937E26A83A6ED43C5DBDCC8C8E8E9CD16A8DDB0DD1A47A7331B59AC63B0A19F9E4EEA92AA680919DD7043EAB1ABA8F8310C7BD62E9EC1A32C17A996
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\MgZKvMc7DV5RedICsSIU2R0o.exe" --silent --allusers=0

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LHEl0niwjoltQS39V2LJgECA.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.974628355944435
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5M12GzjzivJ2AQL:fE1WXp+N23McGzjOh2P
                                                                        MD5:A48E40770D3E2568C2BBEC528AF3EF1C
                                                                        SHA1:03E4508270C48EC8C48A52CF563A82543D48176E
                                                                        SHA-256:F79E9DC5E29F749731A882D0085ED4D698AA4DF193DAE6CF25AB8149E3D7F699
                                                                        SHA-512:9D52A2374D46649AD53414C1BD2903F44D908B97A04977FACFA924C195597728B9FE07D73243A15836EDB78E8A68E0A1B8E800477832FA572F27540649566C51
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\iPhp3cV97VGJ34Ref6E2pORE.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M6d7Epczs7g4ly9ridfMV5Um.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.770282479566032
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J59RhiHT12dRtOn:fE1WXp+N23zhizATtO
                                                                        MD5:C639FD842F2AF441CBCE7F6A6350E691
                                                                        SHA1:1841005C0F60F35BC837B9006990256FCECEFB3A
                                                                        SHA-256:E1854DB7C364AB68A0A8F7745D4556A72D386C6353871FF3311529D5C36743CD
                                                                        SHA-512:C37359EB67CC7CA696520999ABD54963B40E2D4F318AD6C3D115B2C92DDA45492A403B806BE942B938358B634CFEE22B85CDBD59CB8650E6103C4267B758E5BB
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\X4G1qMGsevrGDCsTxtK3q3TA.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M7S73t6hBdZDj23RDOUIkddh.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.360903502122424
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5XCaIAA9QZULKiyfsj2o2DCisF:fE1WXp+N23SaRiyfsjP2DPsF
                                                                        MD5:E5436168D1776979B0CDB880D9B79B58
                                                                        SHA1:81D85473E8DDBD8A57399B00FA09F422215C2C4F
                                                                        SHA-256:D790418904F80EBA5AE9926983DA4DCF448F5B390472A8424DCE6CB5F2A6066E
                                                                        SHA-512:FF09B0ACEAAC378AF51C3839277334E33EB7908E0F4D0F815AC065F70E2860EA06007F309A68C830B3E866B63EC3669F6962AB6A21DBF184882D96749AF679A7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\rOWY7QA6HmKaReenlQLKGBVq.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MpI6yHPMnpE9wO0VLneXkBvT.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.9237620515339
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5/uzKb2u0sn:fE1WXp+N23bb2u0s
                                                                        MD5:81B2AB10B033753350A8E36CA3B39766
                                                                        SHA1:B859FB29C9DEF14B4738BBD66E1F6EA42890F1B9
                                                                        SHA-256:CB28D9B7228937FF411B64E532EB61BB08FF26BB8D5D61BE55D272F3CD3B6099
                                                                        SHA-512:5DBF2B3F15AD24EA7CC6C8AD383E445332F0491402DCF12E7EBBEE3D027EA36139948946F2B29A8C81F354CDE3A08CADBAF34AA675CC1518EE3E954C05E4D15E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\ZMVfke3FfhAYexvtpGaP7QO0.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OEQ6K9YiI6P1luZke1R8ZVud.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.963687957362355
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J51ggUxWJc4Q+RsJln:fE1WXp+N23bRcxL
                                                                        MD5:31BF6418AEB39E71F87F44A3E135468E
                                                                        SHA1:6F8E59B8086AB4BBB2A94913EC8BD49C5BE6CA19
                                                                        SHA-256:DC4E71C6B3CB0B11D1DCFE60B1EEEE0B69EE6E91DC562F0CB625B0E93AEAB39F
                                                                        SHA-512:1190BE808CC938AFFCBF137FF9E460B6718EE7320768B695082B08BCD8DE6F2E36A35B20F9B8B73FFA3BC2414F7B4430F3E1CECADC1D009A662E6D35E517290E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\PEETw0QK3zD9r7HEE5AR45AO.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OJIkGrj7wa8sdrCAl5rVAqI7.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.853403312805301
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5mJBMqu3AVdJ0diFn:fE1WXp+N23mgsdl
                                                                        MD5:CCD6ADC36AFFDDC831D1309878C1B0DA
                                                                        SHA1:DB9CD42EB2BD6306DF1003A2DBE0C3645735E003
                                                                        SHA-256:43692DD518C1A827F1EBC276CD1BA3CB302C3FD1CDE6DC8578A993EC5D3220B3
                                                                        SHA-512:8D68083FC0155A0457F6DAE9C02A6F79CC7CBD9A11035C16D070AA59D5B852B98FA3B4ADBCB0EBCD13E4FA562BDE57DE02743720A29B3F00110C27F2B8CF1A7A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\CluIFFuzrOPmXrVReYWFXWkl.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OLS2gd5i4fNCKRL2gGt0JX1k.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.876731435623226
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5xrJijSOyv/dAHF:fE1WXp+N23tojOCHF
                                                                        MD5:8185EA33BDFEA93EF0624C07B7FED83F
                                                                        SHA1:8DC8065F646A9F0DB3F3681D5A21E5A7A2BD33D7
                                                                        SHA-256:6AB0827893B1054EA54DF801E86433B8A40E5B7E7E32759999965E91CCF8CD9B
                                                                        SHA-512:C200F321251420B9D4B6FA099EFAC848FF324E9C0F71EE7FEBCB8514CE870DEE7F9B324FBE50CB4FA72581166657D7AB6D4D2F790BFF796A9E4745AF06E9A1D1
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\TNzDEBB9FdUrEB9ZmBfj0vTU.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PB9LzXES4aybf4XF2Nl44BCv.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.934096015623712
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5XtfN7dSRdmn:fE1WXp+N23dfbS7m
                                                                        MD5:2E2E3CD851C78091E0309C03F590067F
                                                                        SHA1:DEEC90F60FE05C1594E2C235975CCBB88FC4EAC8
                                                                        SHA-256:E93E922AAF8DCCFD956A0492C0B3C9B0581858367615F92037DCD11CB9C3FC2D
                                                                        SHA-512:8FC3D0A41DFDBE3F6EA60BDEE8BEE68F8E4F88D0F469DE3409B90F5F7CC4ECFE79AB9E759EE26D58EF41B0CA4DF32A627C37F11489344D81EA0DE3B8155B40AC
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\2mAvooCfaVYrwjbi8P7aQwd5.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PiUS4qsAk3nJglYx9uYKTWKM.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.849193254030616
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5cWEWehU:fE1WXp+N23cW/ehU
                                                                        MD5:11EB95313A1B7222B583D781E267269B
                                                                        SHA1:6A137B08D21381D26BFC6D99B7C7C40254C7ABCF
                                                                        SHA-256:71B51AC6B098A9E52C53518BB5750909D57B645354F7AEF4777B9E6AB9E52D77
                                                                        SHA-512:A35088C3DF31D854DAF43D60CB6CAF30E2F0E545C5684FB39DEA0FB8AE47A89246DE27F7DAE46195995F87365DD1F3C288772825D63469D148CE268D7B4F3A14
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\yegJdMAIBcksHIcEa37Hzz4U.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QETfbaDRTdtgjhXvrYD8MQH8.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.0121658989267965
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J526UJvjLn:fE1WXp+N2326URL
                                                                        MD5:CCF587C084D11C32948B39AE6CF33740
                                                                        SHA1:7596BEC526A8BA0271AFCA444D87C9AED83327F5
                                                                        SHA-256:426B9D555A3398490CB8B5E84504038421A3D94DD44426DA84E86086A5744C8D
                                                                        SHA-512:5C9A0FE05393F6A497518E759DAC380C2656C0C590B0B9C9FE2769ABF8CBB7E78DC4EB947267D0E306BA939BE854B7256DAACB965587BBE02143D9FDF99AF5C5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\SXfcayqkk1DZ7GAEIik6FBEC.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QIttVglwj2HtPQeFbGsTsTBG.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.860133652612696
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5CzEiIOdHpnOWJln:fE1WXp+N23CzTjHp5L
                                                                        MD5:87E3E4B387213FDC1AA4A3A74F1AC85A
                                                                        SHA1:3283D883F41BB355706E1E22E2E66754D9F9A386
                                                                        SHA-256:4CD7764DA96A93EB2E0D53E191AD1F3A7CDB276D5AFAB945579E8DCA12E55B7A
                                                                        SHA-512:5D1830DDC1CAAE6CC90FB814AC7ADD8CDEE0ED36EA0E3CB20CB991ED6E19295A195ADE49E78617F6B38492F365DE6168D309E6C03496EDBA161D7CC006731537
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\gIwaldePRmh9KRuICLUyfpks.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S4tcLQiJwRoe30tH0sEtEDOs.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.854850638459068
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5zMjku2J0o5xTv:fE1WXp+N23QVoLv
                                                                        MD5:F3C7F58D2E7BF730430FB4DD7B5DAC27
                                                                        SHA1:BC271B26B5075CB9D883BEC20A5AB1B951C640CC
                                                                        SHA-256:40F968F6219FB5D26781F14CD20522CEF4EEF904377A084227BA33D67B9181CB
                                                                        SHA-512:EE21D27AEF47A0E4F0AA8D97DA7EA6618C65CA1DC19CD8AC6D55A5169803F22FCB5FED3E84478F9855BE845CC3DF75FB6D473CD4B09C9C8EC3D5FCD47F995F07
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\VWecoOkiAKSpFQMeoTrTyGCa.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmuO211gYTn8iCs01aaXkTed.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.021658971855109
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5c3HiH0pvzn:fE1WXp+N23c3iHo
                                                                        MD5:3E1CE99044BAC8987CC01F389BF8D49C
                                                                        SHA1:7B508964508831C72AAD33A5D6D1786767166D33
                                                                        SHA-256:C0E7028EFE5595430F498BF6EBCDDB733B64A5594AEF6FF510D809B6F3DF8437
                                                                        SHA-512:B7692EDA521ADAC1A307CBD450F7903AAAA3B335CB86AB83BF10BFE4605065DC0727EBF6CDF24BF11BC19568B2C1F0DE104F7A73DB4817132CA5F32A09BCEB9E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\yRbowIjZdxellWMLi8kEb6gJ.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T84nsKO1CTEA0v5s172Ng97O.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.860133652612696
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5XSUeqTgUnsKZc0EFn:fE1WXp+N23NHgUsKZcJF
                                                                        MD5:5727305C166BA9BFC69799F8DE467160
                                                                        SHA1:281DC11608AC981F455DF10831D20BFA42EDD771
                                                                        SHA-256:0E0E7CB2119E6F0EA1499E87CE8B71C3F7BFBA7A15438876DD18B724D94D073C
                                                                        SHA-512:DA572AD5E5A5D07959487FDD39442167B366A354FF80E517D118F6ECA2C9F55273353E7B45FC90B56B021F4A993D36F34BBDD13D76BF8BFB5E05063793D37AAA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\r7udPMXlAvzgwc1HpIoaUJHs.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UdKSHjICWNJimHBknLaPjXaz.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.079629986347863
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5mGitN9WVG5:fE1WXp+N23mGMSA
                                                                        MD5:836773A770E891D06FFC9D28B6B15A4C
                                                                        SHA1:B9B22834E3DA749E7282D8B0F74358E5FDB14E49
                                                                        SHA-256:E8A032CBAC532A0ADED1EE693ABDED3B2C38A96853080E7D991B3FB9DAC31C80
                                                                        SHA-512:73FF7CF9630D0D190A8C7065548DC305FCF8E2A2FFED8ADD99D9B534765162DE3B3B673531E9A3F50EA056FD207EE8114A16590B906B5D3420D96AFBD2099752
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\C2TkN5RHqTOX5vO30NGDVLbB.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UdmZfQQ5qXAW8NHTfIDGE6mL.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.876731435623226
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5AKfs8+AmfdiFn:fE1WXp+N23AKEM4s
                                                                        MD5:D2CFB1FE4C9A923CB67E0896E4B017F4
                                                                        SHA1:70F4DFC24ACA0B1775937F6DC0A0A457FE5B7E6C
                                                                        SHA-256:CFE83CB332C86C5F2B6CA7B01AD65F957880D3702A6A8F410A76BF2D23CC7564
                                                                        SHA-512:073EDE17165A9879527462F31E2F14241F9410CE98C9EFCB917486134A909848A4F8E2B6DD9DC8C872611BC9E00052BD9C0FE5B8D702251B80E4F77D361E9752
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\ekOUFFIwIeDOzbw9eNWrMi30.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYHdYGipdDukoUN4vtDtIoGo.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):71
                                                                        Entropy (8bit):4.942020274971521
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5JmvVmv00dAHFKWn:fE1WXp+N23g+00dAHwW
                                                                        MD5:7F7E07C088AB76897CFD05AE3377B115
                                                                        SHA1:878A31206D6BEBF74698D344F0DA2A9FC4BE9A15
                                                                        SHA-256:7E709280A71AC8BFD490C62484D61AB04684A9D1D420BDBCD9093D1CB113F30E
                                                                        SHA-512:A1C58A234BD549C6CF5CCA754EF6DA52A4081B4BE63B5AD28C4E909E2909A93C927CB47BDED3970AD14FE8B7D4632E5B6E7945D4A749435CDEA133B2BF15AC1D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\lCgtZ6E4HkEVDH0ClzJMZwZY.exe" /s

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VhTJ6AtzebMaD1wtY1ld826g.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.959852268862495
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5pNI8UGc/8Wpon:fE1WXp+N23jI5HG
                                                                        MD5:4A98A8DE1128D7C1F5D157077DB82F67
                                                                        SHA1:54570D89F80680208FD29DA7F7B661457903C2EA
                                                                        SHA-256:3794FF46E6F14C4E3A9C5138E865C50EE89DE07D46F725405C730D7CFA0D0A36
                                                                        SHA-512:E46614CC221069F81841C0BCEF1808C33174F0232C9B6572F5C0C6712A1A8377BF848DDCBD7CFD98717EB2FEA5993F9CC59E234E33FECBC64410A283917DBE6C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\LhPgYqY29jVhDYACkOwz5AiJ.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xc8ndnBgtKiEp95qA74vXtJn.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.068689587765784
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J50uJczPsf4m:fE1WXp+N230RPxm
                                                                        MD5:358FD98761F62FEE50B1CA83A9D75FC4
                                                                        SHA1:5675B25B5E5905C7E9FECA6D92C3AE06FBC1E5FE
                                                                        SHA-256:BB1564EF99D61F6B27F7F052E056DFEFC695D80483B2546F85B48DDB598EA1DC
                                                                        SHA-512:9A9D48DC5555DE0177013D7FF5B77EC971B0CA18ACB7A78B4EA5E18376B3F82FEC05D864F48E389AA643D44E2A3A6286195F305CF0BFD5F0FE63E21B47976530
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\QmwuUY15y0L4DcEZ4ogFMHTp.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XkIN41cGFrm9aGL6NKqH1FLp.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.725073559583948
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5ADWsx+BhzF:fE1WXp+N23AvcF
                                                                        MD5:62A4DEC6938EA575BF6E393EC0E1E886
                                                                        SHA1:E1B8F7CDDA940C7113D6F1287169192BD029CC90
                                                                        SHA-256:C4D332F584FF1E7097F150640607A3F10FAB29753D09040CFB3FCB4EF1F415CB
                                                                        SHA-512:B672FE6887D4ED6231EDDF01B1F5CBE34969AE74E67C198DDF19B788C3ADDDD51ADC3454CA34DCB4B65FD6C2BD271BE100EBF16B996EA759F5CE82874541C23C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\ex3hWoysxxQp9yfxr1vhsCEu.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YCn5gwEDkBtWGFrNNMijrH2o.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.930866761616118
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5xGWOhNjqaHWEF:fE1WXp+N23zcAzs
                                                                        MD5:7CFBD2F04E8DD95D0BCE4C8D7EF12ECE
                                                                        SHA1:C178D4E4281F35018F7E9DC48CA35FD023871873
                                                                        SHA-256:6FFB6EC6B2279B6A02D81A36658B05C0615DF2B21A5338F4AF4587412C219F4C
                                                                        SHA-512:5305498D738F391992D37BF2478C53906D7C62DB8132E99A21B71DB89201F0AF66CD08ED4024AF4687F6B2EA33F1C64C8183AA6F3341241B9207BD1602A070CF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\Tc3J3MYPBvAb1zFAQ5lDv3bp.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YPBkrWCoxboqSNx8lEtAyzJ0.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.956583247280139
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5jAcWtdmJxyRNvLvn:fE1WXp+N23kcWtiy7
                                                                        MD5:D949CB37494FF310C73C009B64181697
                                                                        SHA1:75C5A8B97E78BD5DE92F810E2F867730A24D16D0
                                                                        SHA-256:4C5D822279EF1391307ED56E8A619D366EF43F6F432A53F2779EB5EF6C8C2446
                                                                        SHA-512:01A7E40CFEDB17450B4578E324CAF2DDC4251FD25EE24A42A85B6CF6C65FBD5FE45A940D3EE12B59210532CAE4BBB0824A77C5E61A42F2870885FF0238F37514
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\FJSjysH5UVVCzLZbTWiurcoJ.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yvdmir6PCG9PcsgBUQPDicbH.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):71
                                                                        Entropy (8bit):4.952652493311851
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5UTXf0phSWn:fE1WXp+N23Uo6W
                                                                        MD5:DE95AF0F0CA122A981265FAAEF19C6A2
                                                                        SHA1:E8B76E33B2027AE8BA32D5172D7BC46F104B3CE1
                                                                        SHA-256:0BDB8BB76A0879BEAB93AAF6F6696A6FCB8571B44616DA330CB060E88C6C5549
                                                                        SHA-512:4D4BC1A42BA2CD61BEAC906551E470E03233DD4EAE4D0BCE009EC9144374D38AFEEEC6877D1AF8A293CE1B066E0E442120674ECC832C03D81ADA09D1F1C68DB1
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\qdXZz0xbr8NxLE1KImKm0Ewp.exe" /s

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aNUjsDMzxrUZ9pMyOMHt7aH1.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.849193254030616
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5WxXQWufHz0sn:fE1WXp+N23WxXZ0TL
                                                                        MD5:926EEB2A56445CBD23ABEA88EA41CB30
                                                                        SHA1:4FD3D8770136921ABF368F9BCA472424F8861E1D
                                                                        SHA-256:F6D4D03E053565A5B52BE7F2DC6CD5F65840AE64B2A2B9CDE16BECFC45FA2B47
                                                                        SHA-512:094AC187AF9680B5BF5B95F48520D663A35214D7FB34AC825EF583E1E77C34B31C32A5CE388B6BB64A15F430EA564DCA8A3678949403AA07AD3FE0F535F93632
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\sPCxEY41osSQyAztFqDas2bV.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bMV0AJsrIFEu61FsUzZ3Drg4.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.872895747123365
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5KVXnctVhpG:fE1WXp+N23KpWDG
                                                                        MD5:D25A5EC63AC3C57169437A741859C0D5
                                                                        SHA1:CD9FC241DABD99E0D950D6CA6ED1F8B4F9A66678
                                                                        SHA-256:0BE30033D99F4B5443BC89C5DC151B51B8387BCF75F8457F580CE657ABA4C827
                                                                        SHA-512:309D03E3F1DE652B88C18BCAD759CE0F851D9A27FDE8730E365F65B2E9BA3BD850552FADB643F6AE8FD4BFCAF57FBCCD5610F8DBB1D1D8068688C1EA79434417
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\opugKRO9HQIQrHGr6X89OLro.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cT1woQpizC6vcsIhG30ZQlQi.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):71
                                                                        Entropy (8bit):4.837655351954378
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5NBQsNlkV0sKWn:fE1WXp+N23TfrW
                                                                        MD5:4D69BAD79D4F43F6884212B9A2EFB6FC
                                                                        SHA1:85CCE38BD5F7C2247B646DA12CBAE97332C5F564
                                                                        SHA-256:0D7BE0103DA58D8A6D8B09BAE886ACBA18DA04286DACDED0F3D50A2A3CB64467
                                                                        SHA-512:1558C6C4707BB4CFB36D8A4B185108EB6A58C66D54C7F8670FEF805CD36FCD324E5E7E9EC220006FA65A181F03E196962423AF5CF971D0E466CAEE84DD46B170
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\hduocco6pWLP0HaA9bgAhije.exe" /s

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cqnfn7K2uSSgR0BK2dmSG6RT.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.067242262112018
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5y0DMybDJNln:fE1WXp+N23yj2x
                                                                        MD5:0C0F2F5D723369ABA9FF11A20FAA5321
                                                                        SHA1:9351F261181E17FB81C97EC08E5A0D9A01392DD1
                                                                        SHA-256:BEF871688248436A4E175829BAF10221B0DD9950406DB387A0D61329BC5744E9
                                                                        SHA-512:A467415CDA085A1288AE5CC6B648A30B56E2E07FADA9E73F91AC5BF63B2FC3122470572E3FE83656CCE2EDF99430D169DE201343E26418C0122EBB7BBC5B67A9
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\WQ1sXS4A8SPQ3OH5qUwmsfK7.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dOE732BLSg0lcFC2QsLbsVdq.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.331561590122894
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5cIU3QnXACgvBQL4mKiyfsj2o2DCisF:fE1WXp+N23cAnXMyk9iyfsjP2DPsF
                                                                        MD5:A2973EB68E0A5F953AB0805B65A2524B
                                                                        SHA1:23B283E9E5D75E2543859930EEA555CB71EC3732
                                                                        SHA-256:ABF32119AC72BEEE407C984675EA7BD55B59D3E889A4AA6593919679863762AA
                                                                        SHA-512:00060AF095AEFDC208BF197DF9419E4632C0503052E8A606B7C01C5D2D3A109DAA3A8BA90FF63416BBE45A0DFE42154258230E0ACA1232563C9D5BC2A2B672C8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\90MmY3vsUc9ABzZegEZBdNOJ.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\doYPozeGIFDZmObCagCEQLu8.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.032599370437188
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5BR/cyVQpeQLNHF:fE1WXp+N23nUyVQRVF
                                                                        MD5:395CEE8D110CA484AB38AD79695F134D
                                                                        SHA1:EF21270BE6CFE5A9FFCBF018CD32F737ACF7E970
                                                                        SHA-256:EDCBE844A5E9E5AB189A0C365BDF070C35B7D6BDC0D9CE7937B4B92B820E0D62
                                                                        SHA-512:029D8963DD483B35FBC939F192A3759D3C1A2D9E1B10AD504D9BF7E5458212C5CD5439AEF928A12A4FF29328B682EA8BE3528F801A7FBBCF4B592BCDE3FA15D4
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\d4dL2ywdYIMevGjO45NXflQu.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dtKs2tS72ZiQUqQJbm6PlXNn.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):90
                                                                        Entropy (8bit):5.069483446681397
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5dPQFp/NTSO7iFIkdan:fE1WXp+N23NQf/NTTuyD
                                                                        MD5:1B37FA7DC65C6F877E588CA92F5F6E51
                                                                        SHA1:6609B2D18CD41152844EC2EAA0B92A63F84EF742
                                                                        SHA-256:F873C5B4BDB77B3EB760CB1CE4308321AFCF0F70DA79962AAE3CEE6DCB65AF33
                                                                        SHA-512:57210904EF747D42CF944F582C3561B1CBC208FDE700A6DD0914DF3972B1A3DC7F23F42B77B80B540B7D4DA1993CBDB8776A8D99835C0E472E7C1421ADADEF15
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\8jjMtFTS9Zlbf6vKPpWxHhte.exe" --silent --allusers=0

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9VF2IVEsQy2wXp3Fmzr839j.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.93470245011598
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5QtKCtGyEdo4amn:fE1WXp+N23QrtGy0o4p
                                                                        MD5:4D660969720AB026C575CBEA882C9674
                                                                        SHA1:88B9BF46976BAA3B86A1087CEBDC0B815431A679
                                                                        SHA-256:03567928A260E48552D4361A2F80E26EE7FBC0D3C556651EAF202CD9823C2A52
                                                                        SHA-512:454372B8806343BFAB24EC1929456DC8C4B58E3D7372026B79E725498E9AC778ADD5EAD9644AC33F8DCE163F6EDA5336C145841C3BBC92DB1EB0BBC2EFC4EF10
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\uHshgHc7dTYJxuLdXX1zGE4V.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eGd4n9cCkUYchxkeXTXmdykg.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.010718573273031
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5WtqhrEs6Jl:fE1WXp+N23WtqJQJl
                                                                        MD5:4E7DB8C71747E86730BD1A0933759EF7
                                                                        SHA1:0C42AE33483AAD4FE1607D3C0DC1757F27F09790
                                                                        SHA-256:DBF13024467B2E92CC384F529235871D0F37DD57483518976AC03F3E9A02ECAB
                                                                        SHA-512:FCC3475DC053B756ABD3704BC2B40941B0A3B228AAD2E870BED7942BA8F1ED8B7411C459C6B3B2697850DBEFE9ECA657C673AE4A4546D58538A66667B84AD298
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\3R8Ck5RbDm3DwHyYiEHPdMPU.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exzdtm0wZNhsJNbT7QPWRUFE.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.927597740033761
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5rLExIJXLmSN2AHFn:fE1WXp+N23Iuh1l
                                                                        MD5:8FD85FEE65ED725F2B62EFA1FCD5B687
                                                                        SHA1:FEEDC460478BDF09040518490E1601D54C3C50C5
                                                                        SHA-256:64A89E7F8173912B228E5DAB9F625EEEE71C5FA79833C9214CA3B97DE0975789
                                                                        SHA-512:A389D5B20D784A43C91C6D1DF61300046076BFCABC3A13DF82BC7D711652FE036739259C790AB0BA27AFCE3859040BF599E91A72CAD4D64D98B35A01AE63891E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\NjXePrSynHsARTml2YUxC7hl.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fMA6KEnRS3bOmy31UfZkaOcX.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.003613863190812
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5G/Mnf1fP0Cl:fE1WXp+N23G/MnN7
                                                                        MD5:E2712AA15C452DF3387807DED28B92A1
                                                                        SHA1:699DBA9A4C9FCBA346379D3EC0B556A5E3B912B4
                                                                        SHA-256:07917FA8E699C3C8E1D66E295CDB874516654CFB65673526282489F6F2FED8F8
                                                                        SHA-512:EC5A3070C892DB9A444714984CE899009D02C6D2375969758BCDFBBEBAB4076D64CDCD2ACD30451A79AFC74CAAB1CE3B71C300C43C5A8F2D6F3497D0201E0192
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\c8KXUlVEBLWKm0FvrBR7FzOQ.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fTbmVIx9tHa82q2Xw16exu7m.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.933255124462213
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5AevgiNHoaLVFn:fE1WXp+N23ARGF
                                                                        MD5:0EC396C3035ADABE8ADEF0DBA3DB0CD3
                                                                        SHA1:C0A91B415B3D4D4A869C737E7C426EA4007C387C
                                                                        SHA-256:C6F71FB80087A5E8302D35E9D04F7123E98BCEBF379A8ECF38D17DECDF02A320
                                                                        SHA-512:65EB0E3DB6B2CCAB31588B6AA4DA03DBC3910AE22DA8EB2B0D5AE324F3B572A012D21061863894E2AA2A1B3BB4F319CF1643C59D02516F74DCA964AA6B69A52F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\en2Jyn1qg7jEGhbzerb4PGCA.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ft6shQtleq2YoP6uxtjELNIa.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.974628355944436
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5RVg+z2Q/D0Ns:fE1WXp+N23zJL/oNs
                                                                        MD5:CB360C6BC1788C0B9A45196B7076E5B3
                                                                        SHA1:4ABB44AB1B95C5EA77F32975CA259231EF99E071
                                                                        SHA-256:91CBADF5B36779EFA5F56DDF3FFC6D3A732EFF727727A155CB618CAC5EA8F30E
                                                                        SHA-512:53BCE5E412260567652C56A08E17672AC5EE0376997C71B6692644BC989136C6C7562D8AA4BECDF6C9DAFA9B3AAF90BA8DE7DEAA107A6EAC2F7921F4948C3D1D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\t0EOMhSnTVCOCZS9qZwimCQw.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g66AQFpQYrLlKLwe8BD5OCfh.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.021658971855109
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5yQSGWPwLNl:fE1WXp+N23yQSdILNl
                                                                        MD5:A49F3B704368F2B41AB6F4AEFF904F01
                                                                        SHA1:C12811FACADA332C6FB54590977235AB704A8B24
                                                                        SHA-256:50AC269F9F7D9C5FB034811B4E809E744868706132C87745120DF7FC87088CB3
                                                                        SHA-512:2A93DD9344169DAE1E4269730DABF0E3D3C0F215DF12AFD8ACD84812C8C13949E42E7EEF5520A1D5C3350FD3B8A8884B33F330AB5FD748A17047BE72427EC547
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\Wuwrf4eUOpvmHyFvQ2XCPgVU.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gEatP5rYPHhzi7hzLCguIIkD.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.860133652612695
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Au3lwdiF:fE1WXp+N23Au3nF
                                                                        MD5:CEBC0E9A66A57C332B4258554E11DED0
                                                                        SHA1:CBD8E08BC7B496F6CB8CCD52AD3FB795DD00716C
                                                                        SHA-256:5AABB7E3C218FC69EBA01F92321D5CEA006F6E3240B6D4FF048877375958831F
                                                                        SHA-512:85DC008FCB14512EAED85A7FDCB2BB1E0633A6F30A262D5448A4F11CAE2EC764264AC075071B8FE1927ED783B3B83458F9B8FB024D90AE4A28590F84FAE20F5C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\eKHEatA2YHjGupA41pjTqd4Q.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hiUMZ8f6oKK1xINDp3JWAlOW.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.814924732630612
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5f2GwyoiAHF:fE1WXp+N23uGwyoB
                                                                        MD5:A43678854FFD675F791D0EB6770E0FAF
                                                                        SHA1:21338D962B7F77C208C1249E2B4D1A661517A507
                                                                        SHA-256:F911EA4040E0BCF6790BAF8EFE0A742232531D1F610BBCAFE0828CFD6B3FCC86
                                                                        SHA-512:802242F2900611B45B55B3C661B628357DF29FA15091A0CFBD1176E771EFBDDF0EF1FC32181FEF85EB4C4DEF55E851E8B2D06380641BC7B74B76EB3C4B4225F1
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\zDIXJhMuVzNtJxExlDXABWMh.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iwDuhOuTh3OumoPBD4ROUdv1.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.865791037041147
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5fyNcGJl:fE1WXp+N23OJl
                                                                        MD5:8CB2BA2E5BDAE4BFC866B2DFE28E1877
                                                                        SHA1:7839DC71A7E0E6739D7A565A435677BA229F3D7C
                                                                        SHA-256:CD2B3FD2FFB93EF2C05A23629717BC77C304345C032F99B7AEA0E4B689C6A515
                                                                        SHA-512:ECBCA966EAB584046D240BD3DB3FB5FB6F354C80B98A5E6D8BAE166B7ED601FB6309B10AB10EE2C5A9A5351AB0FB6E5206E6C2E44EB3B3D357A4F87CB1101A57
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\zUUHNzh5T8q1lb1rXsANRm0p.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jU9C5BnteHyTc9SaNrtdcXLF.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.945642848698059
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5RQUUlMML7m:fE1WXp+N23dJ
                                                                        MD5:DBE738468FDE3424C1E000ECABB6F4AD
                                                                        SHA1:96548C1E1047D02463CE4414056F8BCCD7516AA7
                                                                        SHA-256:17A5AC48DCBFB78E8207B509933AD807147E61BFF949D91B817B328C3F92EFA0
                                                                        SHA-512:9ABE03602CAC2CF338187A17D5D8A38C2522D2BE962B529C7AB8491216D2A9A54A5D57678F55361355085330756166391C30BC9FE311E7E9770BAC6360B3A97E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\45jOwggrSgiiBeW99lMmxS6j.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcCVWu7ZYHEafDMGCkY7sR2G.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.3927936075908445
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5t/S3R/HHChgdAQiyfsj2o2DCisF:fE1WXp+N23NShPHCGriyfsjP2DPsF
                                                                        MD5:06D8DAB710C597F763CCE7F35E503AB2
                                                                        SHA1:773E2F9EE71C516FDAC4A102824AA88B842CB9DC
                                                                        SHA-256:1A45CDA31FCED6401ECB4822478D7A615101CA792BC2F3C8969EF0343B8143EA
                                                                        SHA-512:3395E36CA1D5A99A27F06CD7830C923E280FA1BF41C07338799F0DDE71A8903B5957E96349F8D924BFD30C6D0503705952E1A77CB2803783E956A537C8D73AD0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\HZmkan0RtnpmEbbLPyds7uQ6.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mA4Aqg8LeqPlIO7zNJ1CDIlw.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.807820022548394
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5hqJyzTGULWdmn:fE1WXp+N23fFLWdm
                                                                        MD5:7BC10715C1AEBAE5C0B5B3B4131EB527
                                                                        SHA1:6BF1FA47224C85270825D732FB40FF8629B97CCB
                                                                        SHA-256:CC6079A0BEBFD5F7283E77A2E0825DF98ECCFA46E38AD83F69C23E043AE8DBCB
                                                                        SHA-512:0F3D3811C8FB6F434795C6324BBF3841B15CBF393D013D9FEE4D0EEB2281CF2E01734207B109F0E7364E789B2B31E33FC8CA0CFF9F17970A27DA414644573276
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\DOlWVdd6vAc9n834oatrVt00.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mDbURsIxi4UnUxZyhZbmGv8D.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.061584877683565
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5kYHAXXnkqOAdAHF:fE1WXp+N23knHjO4AHF
                                                                        MD5:4EB5C9D2B3ED1449E8C1005204A15345
                                                                        SHA1:D0484871BBE3915BB6989C03F6C3B087284CF9E0
                                                                        SHA-256:CD37970D82CD8A554450BCD30FFE3259765D452F0A99FA31F245CC9C33C9772C
                                                                        SHA-512:A3594EE278EED4BA7557DCC9E021CAA447D063E3A4FF219FB3E1442754D60B76D211AE0C5493A602903DEE7B5DE5FE1ABE336C77F97C5F4713F689688B398F52
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\AboFkE91gGtC0jX22BS3GOn1.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mgdvdw3c1wBKaXMXrb2EOv9W.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.992673464608733
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5BnTWBT3yn/xZRV0s:fE1WXp+N23RTWBT3ulp
                                                                        MD5:18B81EB79643678145F739250E852274
                                                                        SHA1:7C31FABDA78FB8E49A12EB622448345BBD44FE01
                                                                        SHA-256:7913B8A3FDCCCA9377604D8FA2867E6A141393BC35E9A17CC1832FB030C95ED2
                                                                        SHA-512:D79ABA723C34A0C5AD943FE5531101B4CCAD0E6AD8A1904EE7D4098EE458EF33A70E16ABFEF7340D72F423B5C0D157DBC544ED91215C2B1B6FC8B550E813853B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\dBv3dMkRlgVVDPZTZMyWgdJN.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nHOXbHeygi9ejoq1v86AFvdZ.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.273551256332657
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5xR5juW9921UzJKLSiyfsj2o2DCisF:fE1WXp+N23X5SWfxDiyfsjP2DPsF
                                                                        MD5:06881524F38C917A0ECA1C12F56F62B4
                                                                        SHA1:95F1F653E1B0C848A47A7AA838668509AEB37B77
                                                                        SHA-256:F04327187084F44C9DEF02FEB978C4696EE22ED061B90864CF9B62019425FF38
                                                                        SHA-512:F03467609A01919C3363287F9F6482617FD09BBA8F820DD7E3E619D93B9D04A8AC0DE6A3A5F5C948A0DD2A5F1E1B5BED09A1DD2C4FC23D7CE916F30F7AA3E857
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\TtG5py94KsXzXSkP3RqVlzUB.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nQPwDzQPxeP9tbtTOADsUnQS.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.876731435623226
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5fXaqJVGA9OdRCJFn:fE1WXp+N23/aqJVGYOmJF
                                                                        MD5:5EEFDBF95C3FA55858E84FAACECE9882
                                                                        SHA1:6CE20DF8F0BF8D8A7DD812C587FD9812EF9D0239
                                                                        SHA-256:36F906FBE83541FC1EC428E94C568BF58E5C49424FF42D4040879954345D6938
                                                                        SHA-512:8DFD0B97F8D3C48545739AE0DCF4BFCBAE2AAC3EE3F90DCADFB8AE7A817E41F113CFF1CDD406AEE2FC9F9DCD3492987C30D50DE85161F05B63818D57F4B25FD3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\z2jspOJECx7C1xJp0mXk8tDq.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o7Ltlgbuhc2pTKM6VdDLYPeY.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.034046696090956
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Q8uJ9CF+rdJ4vn:fE1WXp+N23Q8uJv74v
                                                                        MD5:7F2CC89A926BCB91F934AF11C5F8C9F9
                                                                        SHA1:023DD3F1CF733AD6A931EBCD0A5BF1C2F11AA03C
                                                                        SHA-256:99082910BE9E284FD85977BB0AD62B7F56A0286726F63F2A429FAF5D335AC683
                                                                        SHA-512:50EA68F5AD7B98186EC17FECB53D7AFB932EDC4AFAB32E01C8D73D9C67E6FFDA41C0FADB2141AA2DE79B4895FDEAF8DC9FC8B3F2B8047FE50AC07D261E00E692
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\uYMXNl5sSvaZoW3VwBNxI0U7.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oKpQkZx8V8ZMmplldvhOMwLF.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.940359834544432
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5twppz9vRjWACl:fE1WXp+N23+p1WACl
                                                                        MD5:FC999CBF6BD562B818E0F1605E194D88
                                                                        SHA1:11384BA0ED660DA638703AF95F522A3DF185EA1E
                                                                        SHA-256:93D6205BB7D52CC1405B743A02C767CB8011181022E4FF757585C4E40616FED6
                                                                        SHA-512:883E7AECB39A08E95CAED75DAA3853527DD967A15357E6E225A6C7298487E45DDC0A79F4FEFF89E928258C28D12F5F3F0FB9822F34C5B61B343BB3E60B135F18
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\HUWYuskBZsBLIvSLkwJtR64k.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ogS6GI971UbwFUMRvTH526Ng.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.03259937043719
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Qi2GFMIJm:fE1WXp+N23Qi9FMem
                                                                        MD5:413E0D7EE22EDA9919ED3CA56737CD09
                                                                        SHA1:30577DA4F259560A5763EF06BB8F74215022CEF5
                                                                        SHA-256:D9338D5568F3CA0E795FB7C7658FB9DF1700AB05C169FE4467C9641D96B1D03D
                                                                        SHA-512:CB54082F92B2AD3C55E801E95306487268D3008F8E64294EBEABFBD1046FFD33C6EE29B63D25667586AF043E5C097BDAA34FF9407D9079D293F15A8524D2D1A5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\uGG02PvwRtGMBgiPW7q8rUhy.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\orm1tV5mrVJ5E8pEGOQYpSH9.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.043539769019268
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5SqRc3vXARbn:fE1WXp+N23SqRGS
                                                                        MD5:F040BEA3A2D7A964C955B3D3937C38D1
                                                                        SHA1:BD0D3B31DC91A877355A51900D7BB06AECDBFC92
                                                                        SHA-256:8776F0F94F90E1BBFD133A9287F68560FB9ADA844372A9A47E436D1902A77C5A
                                                                        SHA-512:05B8EEB1B7AE37740CC4D05BCC30DA9992B392E6A26C70CC63F5CA76F0D29541F2D6F61B6C617C27D33AAD32BED9AC564FB73E89A51E679E1B67192A344F0EBA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\7NPiD49RQYuqr08A8L1me5Vl.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pZRcD6tlAQ9BuiAybpYpvOsT.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.945642848698059
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5JykiKojamIqev:fE1WXp+N23H/ojamX0
                                                                        MD5:778BD81ACF4E163C2DE86A2447178F93
                                                                        SHA1:B9FC297561B308C4178BC8D13EF0C6D1662913BA
                                                                        SHA-256:2B5648FA2E2AA8F48421D2829BC8AA6209445CE3919CC353A06630DC7A107DDD
                                                                        SHA-512:BA817B5A53B9FF990847987E4BD3841E25F13F423475819F7B65A4558986262B7B74078F9F55C2D423397547BE1375BE405AD693DEDD70E790099991F4FA2733
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\lWqXWTOTj5tqRWB7LrSzEOfi.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pffVw7spgUfcbHvL0goxMzxQ.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.865791037041147
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Cw/0kk+3jU:fE1WXp+N23CwR3g
                                                                        MD5:1FCD6445B9C1F7AE8F57A0F9327F639B
                                                                        SHA1:D6C38375390790207550BF91D9A50FFA01F403C0
                                                                        SHA-256:CB8F96966E7AFB29665B20C685E5DE5E3AC55DEED671603476F96B6B0C17E0E8
                                                                        SHA-512:4F28C8539D37798422A560E416C8F085039A3FCE224BD92A5B0B0E88E2869A43FF6CE841470425345486488F7869913B2000E145FBB3638F8191882F38040BF3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\gFd0eLtQK8YMDxXc1BQkGeep.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qV5iTvTL8Sj2XqX5shxpgs1m.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):114
                                                                        Entropy (8bit):5.459544839822745
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5DwfWKSgxu+iyfsj2o2DCisF:fE1WXp+N23ivxZiyfsjP2DPsF
                                                                        MD5:BC3EDC4CDB046EE8E4F7B2AC5FC98F5F
                                                                        SHA1:EA0AC801D187D8BE34E75486EBAA7E0154D40CE1
                                                                        SHA-256:D81846AEE4D54D8225581583455446962AF79F5AB28BDF143462EA10E899D2DE
                                                                        SHA-512:40E8D4C69730C795DE5FF39FFC47A6BFDA8A01EBDBE8AD4A153D5E3A9D6747C2209451B5B365D5126F7BC9C43E6A237026802BD2E066E4EF8DF585F442D67B1A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\fwfQo65WjnmzC07yXHDaETw8.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qquxvpgTE06quf47P6Hr5Hix.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.090570384929942
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5ydPyDnhLVFn:fE1WXp+N23ydPy5
                                                                        MD5:7DDBBFA0D8EFC39AB98BF62DC9A14528
                                                                        SHA1:75DB7A3F024691F4AD8D57C5616FE7863B19D030
                                                                        SHA-256:27866CD6603BD8699EEDF3B56DF038DD45703FBF8E5841056A3DA60D14D25C32
                                                                        SHA-512:451FAFF5EFA15CD06F5FE7C8F09CB75661BDE0A4CED94D42210031A5D2B1F0F5156116D84FC27A136CCA2FC4EEE6303F3BDD26D28910598DA521988C09B15EAE
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\WFFvQ6jG19CAfRXHNIBf2RrT.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qsHLHdmkHFgmHHWZoRJcEBWJ.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.032599370437189
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5S6KjOQs5LB60AiF:fE1WXp+N23SSQqOm
                                                                        MD5:A968E49652F21765584D2F2772118DB7
                                                                        SHA1:F2302E18EE04856E2A93635B935616C9B911660D
                                                                        SHA-256:64D215F21153776976B471E1249500617C6279FDE309ABD9EDA6A035B9A25847
                                                                        SHA-512:0061E6FE5E01C49B3A042461E84CBBFA52932DEA949C0EFA1D64B3BB58C19FD459F669B03E60E35CFA1F7B6C486B26DF83E370E851036CD94E9F8B8502FF1F2A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\71FtIFRHiuIrBlnLJFT3ZXQN.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rJML2qbU2x4efJRvXQmhf8RZ.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.883836145705444
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5XDMN3pUF34Al:fE1WXp+N23z3Z
                                                                        MD5:499358B0074927D2CA0BB3700AF3B569
                                                                        SHA1:33B8D1A1C505428276EFA8A86963349B6049FBE9
                                                                        SHA-256:44C5811AD77BA2597130D74E3F79BA57CBF418AD3970AE07510A6B0E7E79130C
                                                                        SHA-512:1BD99D1FFA04C22F7608F16CFE9258F953C4B5018F6DE472A767A80A00C275C4629956DD10F2F37223185FF51A393BB7F2478F2CD34A91ADE85512E47AC769A9
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\rr6NwVvTBpBRblqk6A4rLRgU.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rVQy8crS1kFmaQTOJgtusLjN.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.969345341790809
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5rQDG9zBJUzKz:fE1WXp+N23v9zBJl
                                                                        MD5:2A453F819CA9BC86DDA26F1A07AEA8E7
                                                                        SHA1:605BEE5E751A5BD13969BA05188CD3A5FE485796
                                                                        SHA-256:AC46B4B9832A791EAD3443D903D2BDCC79AF21B7467A2C5DFBAC7AB924235E24
                                                                        SHA-512:6DC03E34A43D63CF192F91F68331C1AB1A4254FBDA8D6C79A62A6FB581EDD70E59F555676C49EFF4893B5AD57B04246B5C1B39AF04362DF1D92A56D873228163
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\N5fklblcsXVYu4JmfhsKVoFv.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sa989uESZtC2k5fPxh7JOAOo.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.876731435623227
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5RUzICUzBeriFn:fE1WXp+N23xBHF
                                                                        MD5:53AD0A56DF7785522B1CD4213A62E0C6
                                                                        SHA1:EBE09A06800F11157C86A79AF6D24E228D98C4E5
                                                                        SHA-256:A2A2392F779BABD647FC803C4FD0042CEEC6B049F8A1A1B4DB1B84DE8F559A4D
                                                                        SHA-512:FCA703780D5EE8714B6D42A81D58FFBBC18226F9D01265DACC57AF5BDEEDBDF4B70BB3687E6E5FB2068CD7568F7735F68365AE32741D0EA69713003BF4FA22DD
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\t1VMdyrwrvacSZR05WqVdNos.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trQ9bZRspPuCYbV3WtPprw6Q.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.981733066026654
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J59cDyUMP0QCGNNln:fE1WXp+N23RU5kN
                                                                        MD5:0EEE98B2503F19CE6E92FBABDD015E3D
                                                                        SHA1:E23D0BC283D6E8E5959985015CC8CE996533B1CF
                                                                        SHA-256:D2C40EA2E9578A9EE996E0F5114A4248CF1798FAB332EB0EECE84B9A47CD8201
                                                                        SHA-512:42756BE285BF824FC1167BAE958BCDF7E6440E40D2B804782935EA67ECA836D5C168F1BD66ADE974975CF61AE56F0CE566C3E393D9FEA96813ABD92D45E9137B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\X91wRWDPO4snjUjOgZjUlicT.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\upUS4SXwlCEkOWrOaZRg0iWx.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):71
                                                                        Entropy (8bit):4.897721021059878
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5WkCkcad/LYxIWn:fE1WXp+N23WfadzcIW
                                                                        MD5:46E7D054D0ECD610C2A935CB2DFC2FAD
                                                                        SHA1:10A9582FB5FA393541457A23929DFCD2E2DB9355
                                                                        SHA-256:EE8626C20B2169A112C96E524FA7AF6513D81B8C763984245856A2D64033DC9C
                                                                        SHA-512:F157037C9C15B0EF1B3FAF2617A932481EDE0D6F8B8D2C11C03B11DD31E7E18540208FBB5C5161C009150032E206A425CCACF07E27F10AE9E04C5EED95335094
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\3DW8qUWA963x8XKarJJ0WTU1.exe" /s

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xwwZiWJtqiPyuHGdDeQvFFlw.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):5.061584877683565
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5IiTUAxeHhMcNtLn:fE1WXp+N23IiTbeBMKh
                                                                        MD5:B717EA10C85832600E62834B9014A9D1
                                                                        SHA1:951017DCBA94D25DCF38A370916BDF868BEFEBE8
                                                                        SHA-256:F74E52F2CACC56D45E4B3214F8AC5A100E98A43EB1E5D4294212D882E4D8EFEF
                                                                        SHA-512:3CEE71A1B962A3FDAAE56A92551F4886F5EE166F0307D2D5C788A4807CACD3D081B8BA330C65C805B2DF8C48309218A8B23C6D7E769C0E801CEFFCEF0F779246
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\mGx41hPeYElMLjZ4bbI9SOQq.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yYAGJkr1nyEU0XfzTRSj3Pt8.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.945642848698059
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5Rscig3/Sk0L4AHF:fE1WXp+N23niYCv
                                                                        MD5:E5E0451287D6B6AE68D19A3765185FF2
                                                                        SHA1:0887DCC91F2CD04E6F8DDC03B2501EDFC7E0E342
                                                                        SHA-256:A5611E9B3861E8DA756F9B1D61A7666207C182A5E087E4F3825CB51E8306673E
                                                                        SHA-512:1BECF0E727F21CB2E92F0A0744E26E0BB76A942EBD6E2AC0C75CDE2AC3C6DA2FA9122FC2E9C85D3CCD8CA3D575A21F216591E952B1DD3A015A47A94D9C4DEFD2
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\tIomxm3YzHufqxsKHNVvwAcF.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yq4chNFGYAkyzyEdaZH2HqIK.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.941807160198198
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5QnotV0IMSbMVwZiFn:fE1WXp+N23QnwV0WbMC4F
                                                                        MD5:2DE8B0FF7A3C532577421FD70FBB58ED
                                                                        SHA1:EF78B8050ADDD0B73F838A4E074CBC45AE997F8D
                                                                        SHA-256:0A04D3D040C0BE768456C0ACDCCC33C1005982EC8EA236A20BAB72773C98AED4
                                                                        SHA-512:E786C65C143B686C21BC94EC988EB978CBBDA9D509A8598EB8E9A05CAC6DA9FF588E6CE89EE6865AB8FF14AA0943A4E0251C97CB0E652A104E4C783AD4D9ACCA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\ucUNYHpQm0C7pIii4CUfIP8Y.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zM2HPwdlDIpliCdYrSbuLgMc.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):71
                                                                        Entropy (8bit):5.014488542967669
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5LuMwWUbS749Wn:fE1WXp+N236MUbS749W
                                                                        MD5:996D617DA9B3C5C8DE61597749A633AD
                                                                        SHA1:AB279A0950F15B414222CEFECC080CE63B1B21E0
                                                                        SHA-256:050FDD60F0A5B9834D56B063E6E1258722122BB8B1508F61E7C7518938457AD8
                                                                        SHA-512:4547FA50D6F51025CA4E9D0ACD1D29B6B271536A6B9DF5B80623894E9B81A9E71CFD2CACCAC84E740FF887D4A4B9B7326540C7EAD24551E0A9E0CA135CB225EC
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\ndfd6Kq0UsE3T3ImvDCKwi8c.exe" /s

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zQTzjmsbagDNgxuMxxvWCD8k.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.898612232787385
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5RvlcSflhPLMLNHFn:fE1WXp+N23JlllhP4Lv
                                                                        MD5:8C8629DFE4A70599DF97BA3F2D74DCD7
                                                                        SHA1:D0D60C640C0031E08FBEBDDA4E4641AE0675A8EF
                                                                        SHA-256:B898D23E05CCD694DCA32277B30C0EA51A9CB7F677BBD919D1194DFF371C6690
                                                                        SHA-512:AAB5D518D43194F5FB8C5E3518C2B8A8CD5295DB7A7E27E2F1A3A31256F51CA992820C7EC956D9639CF1F3FA4649B9C20E3CD5DA6160331E8546997B1EDF2725
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\tJU5p8ys1whXWo8BDeT3nnmx.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmnJRByvDUkcoP7wAlcOz4fD.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.930866761616118
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5IFETUBlM/fNzwWL4AHF:fE1WXp+N23IFETUoftkAHF
                                                                        MD5:B96DA682021538C7FF5E2B55857310D3
                                                                        SHA1:2F132B907CBED71E0921926B8E7C256C522DE59F
                                                                        SHA-256:2D6F5C7DDD62DE1E03A9284618BE00BBBB726B51DBF7A1541C28362757993506
                                                                        SHA-512:8356E555A4FD65D1A036B736DEA760AD394C73CA1A976526894BD38E0FA6E247D47CD2F822551293B4E60D462C0B8A2A49D0776BCA293B798535F1B6F00D6507
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\mdVqxBv1FXzpT51i7izhV1L3.exe"

                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zwMxzFEl9AYYdEJnYuMrZFRE.bat

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):69
                                                                        Entropy (8bit):4.867238362694913
                                                                        Encrypted:false
                                                                        SSDEEP:3:Ljn9m1WXp5cViE2J5xwVyzo+hLNHFn:fE1WXp+N23vxNl
                                                                        MD5:6D4BBAF3973F9B5F45CB031819532EC1
                                                                        SHA1:7CDE94A4FA670F91B76306108B3FABEF8FCB630D
                                                                        SHA-256:9AEBD92BBB121C76E0D08233607A7CF796E6F9D5CBF2085AFA8A99C5036CDCC1
                                                                        SHA-512:17DDC83AB659E10A22B4BCB1FF4DAA7B1FFC5A75C00317C728BF836ECCFAA6D56958C0E9156C481865822FAE3FB0DBC07B723EF9D25EC32541631EF727212249
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:start "" "C:\Users\user\AppData\Local\TUpbZ8vU8BuCVac1Gcxet4HJ.exe"

                                                                        C:\Users\user\AppData\Roaming\jwjrtuw

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):313344
                                                                        Entropy (8bit):5.420552889653068
                                                                        Encrypted:false
                                                                        SSDEEP:3072:9TW8uN0G95ahxyZvs3wMkT8UcaQdJyzYQoWMSCfUC7wgsMet0lvS:VW800s5ahMmvgPcdeY/lR8C7w0x
                                                                        MD5:2BA491F6B487017A1C58B647A7E05D3C
                                                                        SHA1:B5B7F44BF018DE87168323CCEB09A0934EA661E0
                                                                        SHA-256:E46720CAC2A8956C652DB483C7DD7B7FE0BCF7CDF8653D9687159E6355A17D7B
                                                                        SHA-512:14D351CE46CFDE55278C1CF43BB627F47BF469DE84887DAB547EE769D90BA59AFC6CC617D647009CF90C3814F05F85EBF1104550454336078AD0AFF46BDD1A83
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L......c.............................T............@.................................5...........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Roaming\jwjrtuw:Zone.Identifier

                                                                        Download File
                                                                        Process:C:\Windows\explorer.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):26
                                                                        Entropy (8bit):3.95006375643621
                                                                        Encrypted:false
                                                                        SSDEEP:3:ggPYV:rPYV
                                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:[ZoneTransfer]....ZoneId=0

                                                                        C:\Users\user\Desktop\EEGWXUHVUG.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860182396014793
                                                                        Encrypted:false
                                                                        SSDEEP:24:dYvfxTjNnweI//LDW8+t2y7x5lwERo4YqjTXk55HvYHKngr6E57w5Rx7WWbD:IxPNnwBT6822yl5lY4LjTXkHPYqny6Eo
                                                                        MD5:AF2494D4AF17B2B26E2AFA2C6ED56C3A
                                                                        SHA1:ABB6DB13924135A6902E81600D2299B614332757
                                                                        SHA-256:AE5027A534EBDF8A7F31A6801F7D6041DFD7D9489CBA8D5D1A12C3DC7013FB89
                                                                        SHA-512:2F3E3B1D0A09DC5D32FDB5B01809DA5FE7E8C2726FD811035ACDEC209AA5CEABF9CFFAF4441F980F4E3242922B9F9FE0A62CA25B533BEAD44E375DF4742AE3A4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWX...3...S,7..y...#=P[+*..y.e.J.7H<H...Bf.......I+JY.K.'.F&?.....[><A._h..(...5.CZ I.-...R}R.g}..1.~.Y.hn......@:.8?.......k.....~k.....Z.G.1-,.......Ff#...U........:.....u...D..{8.....R..j..4....r.....IH...e......P...\......F<.M2{.1l.....].7..w.~%)G..sw.../.!0#.......3.D.:.'...n.=r..jW...K.B....].....v....h..../=...vX..4.Wj2..h..].i2.kA......M.k,..K.Nr.....7H.[id....Wu.w.#...v.w.....Md$A......Xd.......7..2............'g..MT4.z..c.5..z......p...U*E..u.v..b|6n...x".. .K...q....U|..$&E.....2{.ZB.e:t..E...P.*:..gKO.%......\..9........j....J&.<.H9.<i.....9...x.<..'.-.fW.I`I.~...}I...g...1..$a!;....<Q...,.k.D.u..A..=....W...&....[^..t..'= ..E.+...>........t._.kw...$.2U ..$.O...Vp.i.F..C.8....&}...l.q.y.N.. &c...969.0.7.k.Ju.O..._...T....9.<c^...S.2...X.r.ZS../....PZ...'.klZ........q.]...K.;w...br...B..s.....raP.QUd...#.._......gjK.i..x.e.<..........J..-.........L.....V.$yb.G..x..b.T..L.r...?R...%L......_.A..'h.$.H.....%.w.0_M.s!..i...~h

                                                                        C:\Users\user\Desktop\EEGWXUHVUG.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860182396014793
                                                                        Encrypted:false
                                                                        SSDEEP:24:dYvfxTjNnweI//LDW8+t2y7x5lwERo4YqjTXk55HvYHKngr6E57w5Rx7WWbD:IxPNnwBT6822yl5lY4LjTXkHPYqny6Eo
                                                                        MD5:AF2494D4AF17B2B26E2AFA2C6ED56C3A
                                                                        SHA1:ABB6DB13924135A6902E81600D2299B614332757
                                                                        SHA-256:AE5027A534EBDF8A7F31A6801F7D6041DFD7D9489CBA8D5D1A12C3DC7013FB89
                                                                        SHA-512:2F3E3B1D0A09DC5D32FDB5B01809DA5FE7E8C2726FD811035ACDEC209AA5CEABF9CFFAF4441F980F4E3242922B9F9FE0A62CA25B533BEAD44E375DF4742AE3A4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWX...3...S,7..y...#=P[+*..y.e.J.7H<H...Bf.......I+JY.K.'.F&?.....[><A._h..(...5.CZ I.-...R}R.g}..1.~.Y.hn......@:.8?.......k.....~k.....Z.G.1-,.......Ff#...U........:.....u...D..{8.....R..j..4....r.....IH...e......P...\......F<.M2{.1l.....].7..w.~%)G..sw.../.!0#.......3.D.:.'...n.=r..jW...K.B....].....v....h..../=...vX..4.Wj2..h..].i2.kA......M.k,..K.Nr.....7H.[id....Wu.w.#...v.w.....Md$A......Xd.......7..2............'g..MT4.z..c.5..z......p...U*E..u.v..b|6n...x".. .K...q....U|..$&E.....2{.ZB.e:t..E...P.*:..gKO.%......\..9........j....J&.<.H9.<i.....9...x.<..'.-.fW.I`I.~...}I...g...1..$a!;....<Q...,.k.D.u..A..=....W...&....[^..t..'= ..E.+...>........t._.kw...$.2U ..$.O...Vp.i.F..C.8....&}...l.q.y.N.. &c...969.0.7.k.Ju.O..._...T....9.<c^...S.2...X.r.ZS../....PZ...'.klZ........q.]...K.;w...br...B..s.....raP.QUd...#.._......gjK.i..x.e.<..........J..-.........L.....V.$yb.G..x..b.T..L.r...?R...%L......_.A..'h.$.H.....%.w.0_M.s!..i...~h

                                                                        C:\Users\user\Desktop\GRXZDKKVDB.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8720825746554866
                                                                        Encrypted:false
                                                                        SSDEEP:24:0Nbja3kRYTWatIaBUqVoTwpG2Wm6IQlv6H7Ya88JGmkNL1w9B70Pzo1w1PWbD:EEWYTjDBjVukG2RPQwHt80Ghdc70PzWD
                                                                        MD5:D75C361D5B82C9E20CB2BA6D8C7251EA
                                                                        SHA1:8BF297D58190CB87CDEBC5782E081E9EB7E23B79
                                                                        SHA-256:BDA9EDAC3DDC9CB92E919CFE578E46AA0EA30698D228591DCD5765A16EF9795C
                                                                        SHA-512:C26E30D9BE068DF04AE14E7EADDD6BFDEC4EFAF7FDB9838404744CC4F345793BD79F43238E466366DAA413E4911B0A5E0263B719557FC387C5E94DB5562B89DA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD.O.j...2..p4.3.=..pB...Yo\......M.3....*.fL?FD../3Hm.}......n..;.&.....?SeA.L.....;........"..)w~.;.Vf>.@7...7Q...?.F.K...r.w.-8..Mi.../I.^KV....];c<...0...aOoru..F6p..].}.......,.#.8(.....Yo..b...$...=. ..J....L\...l...M.}...(:.......o .....). .......i}\...Z..Dq.@z5\)jto..^,I...G5..$.W....V..>.[..7.v..>ym..O....[..>.k.+p*....ZF.O.Bd1..*....<....j..|....]....G..Z.._...E..p.......a.....l......`..<.QCH6`..Q.........'Ko..A....b...-5...Th.......G../....E.......>...R.._....f/._w}.%........!..0~+.Ap%.......,[9.......o<Aj.</~1....r......>...#8.m'..:........V....iE..~[.?.p.R#....K.....O.6R...%..Lks..(.c..C.7.*......aT...V#K....r......5.OR.8&......9l....~..4..;k"=1KH,a?sL."J.N.... ... 3 *e..'^.fZ"G.G..)..\i.....m...z2nJ...).....n..[,F./..#......J...Q;.L}.....2\.]....j..sTm...3.. 1.....^.M.\:O0..A.n......m..n.. E.....!..6N.F.Op.m_.R......`.'...i...1.......6^0.Y....\...t......h...c.T...Z.C;....I]..`!..4.....c.......r.....1B...=......8C..KI...{.

                                                                        C:\Users\user\Desktop\GRXZDKKVDB.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8720825746554866
                                                                        Encrypted:false
                                                                        SSDEEP:24:0Nbja3kRYTWatIaBUqVoTwpG2Wm6IQlv6H7Ya88JGmkNL1w9B70Pzo1w1PWbD:EEWYTjDBjVukG2RPQwHt80Ghdc70PzWD
                                                                        MD5:D75C361D5B82C9E20CB2BA6D8C7251EA
                                                                        SHA1:8BF297D58190CB87CDEBC5782E081E9EB7E23B79
                                                                        SHA-256:BDA9EDAC3DDC9CB92E919CFE578E46AA0EA30698D228591DCD5765A16EF9795C
                                                                        SHA-512:C26E30D9BE068DF04AE14E7EADDD6BFDEC4EFAF7FDB9838404744CC4F345793BD79F43238E466366DAA413E4911B0A5E0263B719557FC387C5E94DB5562B89DA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD.O.j...2..p4.3.=..pB...Yo\......M.3....*.fL?FD../3Hm.}......n..;.&.....?SeA.L.....;........"..)w~.;.Vf>.@7...7Q...?.F.K...r.w.-8..Mi.../I.^KV....];c<...0...aOoru..F6p..].}.......,.#.8(.....Yo..b...$...=. ..J....L\...l...M.}...(:.......o .....). .......i}\...Z..Dq.@z5\)jto..^,I...G5..$.W....V..>.[..7.v..>ym..O....[..>.k.+p*....ZF.O.Bd1..*....<....j..|....]....G..Z.._...E..p.......a.....l......`..<.QCH6`..Q.........'Ko..A....b...-5...Th.......G../....E.......>...R.._....f/._w}.%........!..0~+.Ap%.......,[9.......o<Aj.</~1....r......>...#8.m'..:........V....iE..~[.?.p.R#....K.....O.6R...%..Lks..(.c..C.7.*......aT...V#K....r......5.OR.8&......9l....~..4..;k"=1KH,a?sL."J.N.... ... 3 *e..'^.fZ"G.G..)..\i.....m...z2nJ...).....n..[,F./..#......J...Q;.L}.....2\.]....j..sTm...3.. 1.....^.M.\:O0..A.n......m..n.. E.....!..6N.F.Op.m_.R......`.'...i...1.......6^0.Y....\...t......h...c.T...Z.C;....I]..`!..4.....c.......r.....1B...=......8C..KI...{.

                                                                        C:\Users\user\Desktop\IPKGELNTQY.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.840278349228857
                                                                        Encrypted:false
                                                                        SSDEEP:24:CfpSApjU4CcJh4UM2mcoEMZqfuU1Imo82OCvXoUbvWKyn6rYpWbD:CfpSQUEc2r+IVodOCaKy6xD
                                                                        MD5:A0FB771807D4EA4AEA5A6C88F416497B
                                                                        SHA1:3596BED35B419B2656F6CAC76D03A52B1C8D47BF
                                                                        SHA-256:6BE2A2E29F79836AAC26BD19831FF3043C340186C5BAE8A35141A620F707B77A
                                                                        SHA-512:E413AA99A1E39794F113DEC493E3125089761E0C94A42369E72E2CBFCDBA39A9B87822C5F54606EFFB5B36E49612246815A792B84DEC0FEF547C53A4A260BB94
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGEQ.=*N.>........+........+,.#Z..x...X.u..^....9..@|......Wf...Xg..i.]..fR..yo........H8m6Sm.....?.:..u%.A....._.@.^.._V`_..YY..W.yF.n-..)*...r.......P..b]M....<w.S.F....-y.9..V.{uvm...j.6.+.).....-..|.z*....,.`.1*>....sb.1(..................*3......i...7.R......<GC.....x2.Vv..|....Zs;6,...{.......D...'8..'...`P..7..............z...!..`..R.>.......x....{.G....L.2`..|...L.x.....pr...E....[8......D.W...-.:.6......r..;..w.8Z1..4...8[.!...K .b.V..V)m..8h<< H$t..h....D.c.G.~"...:.[..g....N.\.9....1~.9...]..Cx....X.L.[..*.SF.AA...... .=U...<+.!I..!.y.?sq..lCT...g.Q%.x..P{..&;.....D. P....h..C..-...7V.Aa.C.....%N..=.."..,J1l..&h..$........&|:.G&.DYd.?.N5....yy 2....zgs.L....6pQ.HE...Ey.F..x..5..$..;..a...V.E.<..:........e......TN...k.C..EI.q]9..U..C.L....]...).6..{,..6r.u[.....8..e.....v.-..Q%..g....YK.K/.AHkF./:Y.^..a.Fjf3.s..<3.n.....I-.<.... .K...*.....t?....@. .H...1Z..s.i-./..G..s.r..kxi.O:.....i..2...z.N..6..Y7.....S.G..E..e.Xaby.%K

                                                                        C:\Users\user\Desktop\IPKGELNTQY.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.840278349228857
                                                                        Encrypted:false
                                                                        SSDEEP:24:CfpSApjU4CcJh4UM2mcoEMZqfuU1Imo82OCvXoUbvWKyn6rYpWbD:CfpSQUEc2r+IVodOCaKy6xD
                                                                        MD5:A0FB771807D4EA4AEA5A6C88F416497B
                                                                        SHA1:3596BED35B419B2656F6CAC76D03A52B1C8D47BF
                                                                        SHA-256:6BE2A2E29F79836AAC26BD19831FF3043C340186C5BAE8A35141A620F707B77A
                                                                        SHA-512:E413AA99A1E39794F113DEC493E3125089761E0C94A42369E72E2CBFCDBA39A9B87822C5F54606EFFB5B36E49612246815A792B84DEC0FEF547C53A4A260BB94
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGEQ.=*N.>........+........+,.#Z..x...X.u..^....9..@|......Wf...Xg..i.]..fR..yo........H8m6Sm.....?.:..u%.A....._.@.^.._V`_..YY..W.yF.n-..)*...r.......P..b]M....<w.S.F....-y.9..V.{uvm...j.6.+.).....-..|.z*....,.`.1*>....sb.1(..................*3......i...7.R......<GC.....x2.Vv..|....Zs;6,...{.......D...'8..'...`P..7..............z...!..`..R.>.......x....{.G....L.2`..|...L.x.....pr...E....[8......D.W...-.:.6......r..;..w.8Z1..4...8[.!...K .b.V..V)m..8h<< H$t..h....D.c.G.~"...:.[..g....N.\.9....1~.9...]..Cx....X.L.[..*.SF.AA...... .=U...<+.!I..!.y.?sq..lCT...g.Q%.x..P{..&;.....D. P....h..C..-...7V.Aa.C.....%N..=.."..,J1l..&h..$........&|:.G&.DYd.?.N5....yy 2....zgs.L....6pQ.HE...Ey.F..x..5..$..;..a...V.E.<..:........e......TN...k.C..EI.q]9..U..C.L....]...).6..{,..6r.u[.....8..e.....v.-..Q%..g....YK.K/.AHkF./:Y.^..a.Fjf3.s..<3.n.....I-.<.... .K...*.....t?....@. .H...1Z..s.i-./..G..s.r..kxi.O:.....i..2...z.N..6..Y7.....S.G..E..e.Xaby.%K

                                                                        C:\Users\user\Desktop\IPKGELNTQY.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.851892239630115
                                                                        Encrypted:false
                                                                        SSDEEP:24:s1AH92h8T+7PehpG3phufv/+f6ftwXSDaWoMTx2urZI8H87rJreWbD:uV7P55huWRSL298H87rNLD
                                                                        MD5:32969E4BCA5E9DF329E621D471731B10
                                                                        SHA1:F0C07E2372DCA40344CC2E5A104660BCDED52272
                                                                        SHA-256:B0A81AD7E5FE90FD0C24698866EE42A0D917D6FAB83F3F97F8B0941977F519FF
                                                                        SHA-512:DE2AD2D0178996D1F5D390F826D601E278B183BF6E9E27C50BF2AC9B98BDF4278AB5F5B50BF1C22E428933E9ED8D01303A1A5D57971EE7B246BBC30682B5BCEA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE..r.?f.S....T.e...v.p..?.s.y....<k..\.*.]..f.rr.BN._.;0.M.......HP&3K6Z.<....pP%B.m8.y.S.6.Ou.zZ.O.....=.fZ.-W..:....JC|.....T.(....=Y4G....0.B...)...eE.]a.>uC.t5..3..M...?.=.v.O.$TP.B....X.!rg.....f..7..9d..*5:.>.N..H/1j...X.:0^Ip..^...h.../Ue@.....d.t!....M.#..bawN....).t.{....2...x....;..zs...~..E..|.E...........+KJ.....X....}`...z.WB...(.....e8O.t(%...E..[....q.x*.......<;6.X..{..(g a.h.{..(4....g......vz._...m...).va...7t..\z....5...D...o.-...&..0A]s.>Y..p.._..G...k2...".j.xSu."@"M..#.D'p......*j-.^.W..r......b%.t!y....Z.......s.T.Q0rx.v..q.'..<...>&......X.>..#.Hx........6....t..<sz.+..TD......B.r~.>.?<B.2..Mb/..=.P.{..E.....y..sV.uC..>...[..O.zG.".2{o.R..F.{....q.]......>..w.e.W:|O.vi.YCV.J.....x....%O..-.yU..$..sj....mW$...^....Y...^..'."..5...$....U....zn.._... ..0.4.A..K...3..~l.?[.r......,.F..M..........4p....+#.F.z5...+..3v)..=.s.b..v.h...%)b"..I.Ri.!G.D....@.j.C..#.i.."bY.T.~.r.E-. .xC....k<..Fj ...yP..

                                                                        C:\Users\user\Desktop\IPKGELNTQY.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.851892239630115
                                                                        Encrypted:false
                                                                        SSDEEP:24:s1AH92h8T+7PehpG3phufv/+f6ftwXSDaWoMTx2urZI8H87rJreWbD:uV7P55huWRSL298H87rNLD
                                                                        MD5:32969E4BCA5E9DF329E621D471731B10
                                                                        SHA1:F0C07E2372DCA40344CC2E5A104660BCDED52272
                                                                        SHA-256:B0A81AD7E5FE90FD0C24698866EE42A0D917D6FAB83F3F97F8B0941977F519FF
                                                                        SHA-512:DE2AD2D0178996D1F5D390F826D601E278B183BF6E9E27C50BF2AC9B98BDF4278AB5F5B50BF1C22E428933E9ED8D01303A1A5D57971EE7B246BBC30682B5BCEA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE..r.?f.S....T.e...v.p..?.s.y....<k..\.*.]..f.rr.BN._.;0.M.......HP&3K6Z.<....pP%B.m8.y.S.6.Ou.zZ.O.....=.fZ.-W..:....JC|.....T.(....=Y4G....0.B...)...eE.]a.>uC.t5..3..M...?.=.v.O.$TP.B....X.!rg.....f..7..9d..*5:.>.N..H/1j...X.:0^Ip..^...h.../Ue@.....d.t!....M.#..bawN....).t.{....2...x....;..zs...~..E..|.E...........+KJ.....X....}`...z.WB...(.....e8O.t(%...E..[....q.x*.......<;6.X..{..(g a.h.{..(4....g......vz._...m...).va...7t..\z....5...D...o.-...&..0A]s.>Y..p.._..G...k2...".j.xSu."@"M..#.D'p......*j-.^.W..r......b%.t!y....Z.......s.T.Q0rx.v..q.'..<...>&......X.>..#.Hx........6....t..<sz.+..TD......B.r~.>.?<B.2..Mb/..=.P.{..E.....y..sV.uC..>...[..O.zG.".2{o.R..F.{....q.]......>..w.e.W:|O.vi.YCV.J.....x....%O..-.yU..$..sj....mW$...^....Y...^..'."..5...$....U....zn.._... ..0.4.A..K...3..~l.?[.r......,.F..M..........4p....+#.F.z5...+..3v)..=.s.b..v.h...%)b"..I.Ri.!G.D....@.j.C..#.i.."bY.T.~.r.E-. .xC....k<..Fj ...yP..

                                                                        C:\Users\user\Desktop\IPKGELNTQY\EEGWXUHVUG.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8340328826262
                                                                        Encrypted:false
                                                                        SSDEEP:24:AIlgSxZvelKN3T50hS4uwlY3Kf1ydGIek7I44Ny+frUcOWcqRH9wOww4mMRtgCyQ:AIDxVhxWhXhf/Iek7I4f+QNqRHL+D
                                                                        MD5:C3250152DDB5579E848158EB386BC817
                                                                        SHA1:84FB7337C8A1210D4B1D70DFA3E7BBC6F812E2D0
                                                                        SHA-256:EA4EDB22C5FE2E3223F48942746DC3D0B5AED946B8569598552B5132E401CEF6
                                                                        SHA-512:7C6102F59A0CA0AE12C3E606119950490AA6D4B5346927E63160E667ACF4D089CB9508A417664196D876944782E18AA5BF1962EA830D7C9CA3B6A6EB042ADFFB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWXl..".|a...x.B..`...4..p..o.b.k?7....(6.*V..>O..L..!...w.[.J.".c.j."..7P..3.w..[.7...8.^...%0HS..*......,`....M..X.c.-@..`.Np....Y..udu.z9w...j.|...;....SN.P...mcL!r&........$.-/.\hk.g.....j&.lb]..{.ur....rm.w..lt...a{WN..3.6*.o...P;T[.y75..P..Cn...(c.FK4..C....\V............!.Al..w0...3.. O .o...p.....4.E..?.d.../6^..F..Y..f..S)...7.......'.V....BS....e.[1....c0.m..B..).u...Z..m.]..D....P....D.....w9V.f.D.C.V.!e^..[fL$.9...@V.9..\.h.-.'%.@C@.g.aT.*...F....+...D...s..N......~........q}....3@c..D........ . >...i.9&YU+...`....n......mFP...2t.H....B..;..jY....s:..,.#..v8....+......q.....y.`.-n.s.....CS....E.,..T.x..\u...8..t.o[..........#...5.p7@n..U(1... q.b..V.%#H.!...0E..-..v..9*.H<.....zU.F\..U..........B..J.?u..Y\~FG..jp9.#.%.... =+...[..NvR.S-...T1..... ..b.zj.......Q......t.....!t.........wUhxH...d.9....y...u.T..f..)W3T.|..B...4q....0..r....Z..M.^6~....$p....,.w...&bp....I..'.|.w.iO.... C...(.#hE.^..x......PJ{5..?...)^...Pm

                                                                        C:\Users\user\Desktop\IPKGELNTQY\EEGWXUHVUG.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8340328826262
                                                                        Encrypted:false
                                                                        SSDEEP:24:AIlgSxZvelKN3T50hS4uwlY3Kf1ydGIek7I44Ny+frUcOWcqRH9wOww4mMRtgCyQ:AIDxVhxWhXhf/Iek7I4f+QNqRHL+D
                                                                        MD5:C3250152DDB5579E848158EB386BC817
                                                                        SHA1:84FB7337C8A1210D4B1D70DFA3E7BBC6F812E2D0
                                                                        SHA-256:EA4EDB22C5FE2E3223F48942746DC3D0B5AED946B8569598552B5132E401CEF6
                                                                        SHA-512:7C6102F59A0CA0AE12C3E606119950490AA6D4B5346927E63160E667ACF4D089CB9508A417664196D876944782E18AA5BF1962EA830D7C9CA3B6A6EB042ADFFB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWXl..".|a...x.B..`...4..p..o.b.k?7....(6.*V..>O..L..!...w.[.J.".c.j."..7P..3.w..[.7...8.^...%0HS..*......,`....M..X.c.-@..`.Np....Y..udu.z9w...j.|...;....SN.P...mcL!r&........$.-/.\hk.g.....j&.lb]..{.ur....rm.w..lt...a{WN..3.6*.o...P;T[.y75..P..Cn...(c.FK4..C....\V............!.Al..w0...3.. O .o...p.....4.E..?.d.../6^..F..Y..f..S)...7.......'.V....BS....e.[1....c0.m..B..).u...Z..m.]..D....P....D.....w9V.f.D.C.V.!e^..[fL$.9...@V.9..\.h.-.'%.@C@.g.aT.*...F....+...D...s..N......~........q}....3@c..D........ . >...i.9&YU+...`....n......mFP...2t.H....B..;..jY....s:..,.#..v8....+......q.....y.`.-n.s.....CS....E.,..T.x..\u...8..t.o[..........#...5.p7@n..U(1... q.b..V.%#H.!...0E..-..v..9*.H<.....zU.F\..U..........B..J.?u..Y\~FG..jp9.#.%.... =+...[..NvR.S-...T1..... ..b.zj.......Q......t.....!t.........wUhxH...d.9....y...u.T..f..)W3T.|..B...4q....0..r....Z..M.^6~....$p....,.w...&bp....I..'.|.w.iO.... C...(.#hE.^..x......PJ{5..?...)^...Pm

                                                                        C:\Users\user\Desktop\IPKGELNTQY\GRXZDKKVDB.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867231450297626
                                                                        Encrypted:false
                                                                        SSDEEP:24:tZ0YRe7sSIzGiMNN4udhp/lR7iCmNHzmZXFMMZvd70dU5KUM7lXnf5OvuAcWbD:867S6Mz4unR7iCmVzsXFMMZv0/7FeRhD
                                                                        MD5:498244F5296EC3764D1CEE6A5B4E72DC
                                                                        SHA1:A85270BA7306A6E309DE086AADE35CE122C2522A
                                                                        SHA-256:C486C5EC70F0FFE674C205AA4F5C9F4D0751BE64A84846D1AC03650388359FC3
                                                                        SHA-512:75C118AE4E2C0AB8F9701A991A0521EACB26AEE56E1C30D9A5C39230BE7AFA3C172987E245147C5FFCC8C01A0A0F16A23F9F1B29A2A7C02E289F66A751C2765F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD&y.CS.n.,...U.......@b2+.X.#.e....a.o....5....S..s>.p.%H.AN.....4...^.Dtc..4:.om.....'...JAZ.Vv*Z..&........^Wc....Q.l.=A<.5.......<?.B.f..u.8B.0.x.j...)p.bk.3.z...7.%.y...1..14...D.s.u.MB2......;.%.!.^O...;..^.\...v...V...`.@>.l4.(8.......x.......".......`..`.;.XY......YM..x..T.5F..p-efN...4......X."..}.6.gb.*.q.p.t.VTb./..V..Q.......<....}.8qd[..R...I....h.(.N/..#..`;.......$....%...]..!.K.....i..@8X}^.`T.-v.W....)..{.]....D.pM..G....-...53.r...C....._U*. T.aa......o.`...}i...f!...u.l....P..Mk...IM.q.S...O....P.Qq.Nu...:...7.........D.2..Q..>.~..Z.?.S2P.0.h~..i...?k*..!..i....Pw.F.(......,dAc....M.K...........<a..o..v...\...Y....x.D.$..|..w.6g..4O.t...:.7G>.hy....:..d.T..e.s.W....u......#...un.....Gi.[...=...g..1.R......s...q.A...........#9.&gO..(....8.....g...l.....C..kL.b.Q....k!!..N\..7j.<......y._(....Rgg..7jQb...U.. a..Aw..].z...f........{........q.....9.E.f.Vr..C.I+.2A.j..;E........@#.?.5.u.2K....i.9<._E?.r...WF.

                                                                        C:\Users\user\Desktop\IPKGELNTQY\GRXZDKKVDB.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867231450297626
                                                                        Encrypted:false
                                                                        SSDEEP:24:tZ0YRe7sSIzGiMNN4udhp/lR7iCmNHzmZXFMMZvd70dU5KUM7lXnf5OvuAcWbD:867S6Mz4unR7iCmVzsXFMMZv0/7FeRhD
                                                                        MD5:498244F5296EC3764D1CEE6A5B4E72DC
                                                                        SHA1:A85270BA7306A6E309DE086AADE35CE122C2522A
                                                                        SHA-256:C486C5EC70F0FFE674C205AA4F5C9F4D0751BE64A84846D1AC03650388359FC3
                                                                        SHA-512:75C118AE4E2C0AB8F9701A991A0521EACB26AEE56E1C30D9A5C39230BE7AFA3C172987E245147C5FFCC8C01A0A0F16A23F9F1B29A2A7C02E289F66A751C2765F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD&y.CS.n.,...U.......@b2+.X.#.e....a.o....5....S..s>.p.%H.AN.....4...^.Dtc..4:.om.....'...JAZ.Vv*Z..&........^Wc....Q.l.=A<.5.......<?.B.f..u.8B.0.x.j...)p.bk.3.z...7.%.y...1..14...D.s.u.MB2......;.%.!.^O...;..^.\...v...V...`.@>.l4.(8.......x.......".......`..`.;.XY......YM..x..T.5F..p-efN...4......X."..}.6.gb.*.q.p.t.VTb./..V..Q.......<....}.8qd[..R...I....h.(.N/..#..`;.......$....%...]..!.K.....i..@8X}^.`T.-v.W....)..{.]....D.pM..G....-...53.r...C....._U*. T.aa......o.`...}i...f!...u.l....P..Mk...IM.q.S...O....P.Qq.Nu...:...7.........D.2..Q..>.~..Z.?.S2P.0.h~..i...?k*..!..i....Pw.F.(......,dAc....M.K...........<a..o..v...\...Y....x.D.$..|..w.6g..4O.t...:.7G>.hy....:..d.T..e.s.W....u......#...un.....Gi.[...=...g..1.R......s...q.A...........#9.&gO..(....8.....g...l.....C..kL.b.Q....k!!..N\..7j.<......y._(....Rgg..7jQb...U.. a..Aw..].z...f........{........q.....9.E.f.Vr..C.I+.2A.j..;E........@#.?.5.u.2K....i.9<._E?.r...WF.

                                                                        C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867943184145544
                                                                        Encrypted:false
                                                                        SSDEEP:24:9faBDC8pRR26zTB8mGKdDkG7xXxH4tjcjWbo9yQi0g/uNnTd1uGJrbAMGQnrTUvj:ElC36zTKydD/9XxYxcv9z9cMnTd1uCYF
                                                                        MD5:F96EE287E6BD5C0025A5A239C45809B3
                                                                        SHA1:42BF470C767E01BA7A23171C6D682A42EDB88C0B
                                                                        SHA-256:C1E20EC90EA5C9B89D70871DD13CD50D560D9489F1106749E9771B1CE4FB0836
                                                                        SHA-512:739E2C8F41C426F7C4C27D9F14EE92424A6074021CE0BD076BB1C3AB8497C3C22AD765983E46C1D126B95E153CFD3E6F965937131D95F267889AB6F16653CB85
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.Q....N%.E...l.X2..k..zF#.!..&...[h..o...I .q,.S....q.i.9Q..m\....{.=X...\..j%.b.[......4.|C...|2k........}lf....xX....ng+.}(.S..v...w..P.=.c...V[....1Y.A.".%..M..(h.Y..ms.B._x l.!p.....Vf...Kg.H..+~..<..<(-...MAB.V..].-x....T.?....b0.....s....G..0Fl..._8:...qP.u..(=...d....9.k..?.=4.R.....-.......1.R.Q..a.......Ao..+.....l.P.........O....,.`..C..,;.....<..m..zd.?.4q*..O:...E.Aa.._./...O.~....S>4.<...M..m#..3d...r|....S....*^..O[Xz.K...:...=.f..z......T.DB.p.,n..w.;...\.L...?8Fi....qU..#{.....'.a.....@L...A_foA.1<PO.9xQRe.......k...P.Z>_. ...8R....zZ..;I..NG?......o...O.X.n,........m..Q............M....z..v..F8.6...A....s+z.Kw...#f.......j.........b.Y]....F1.$.....:.....G..V#....M..L.G..K. ..F.p.K......w.x..-.L..Q.s..O. ...}..@.9..O".K..3.../......r#...Jq..v......W..0.9......N\*n.3......C..mJ.So.H.G.....+.J]....Tk......C........i.Q...9Whf..l..%6....TS`.....u..:.....=..z'3....@.c}.#.$p2@.;c.r3.^..`.:....^gb..aE..t.;3..._

                                                                        C:\Users\user\Desktop\IPKGELNTQY\IPKGELNTQY.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867943184145544
                                                                        Encrypted:false
                                                                        SSDEEP:24:9faBDC8pRR26zTB8mGKdDkG7xXxH4tjcjWbo9yQi0g/uNnTd1uGJrbAMGQnrTUvj:ElC36zTKydD/9XxYxcv9z9cMnTd1uCYF
                                                                        MD5:F96EE287E6BD5C0025A5A239C45809B3
                                                                        SHA1:42BF470C767E01BA7A23171C6D682A42EDB88C0B
                                                                        SHA-256:C1E20EC90EA5C9B89D70871DD13CD50D560D9489F1106749E9771B1CE4FB0836
                                                                        SHA-512:739E2C8F41C426F7C4C27D9F14EE92424A6074021CE0BD076BB1C3AB8497C3C22AD765983E46C1D126B95E153CFD3E6F965937131D95F267889AB6F16653CB85
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.Q....N%.E...l.X2..k..zF#.!..&...[h..o...I .q,.S....q.i.9Q..m\....{.=X...\..j%.b.[......4.|C...|2k........}lf....xX....ng+.}(.S..v...w..P.=.c...V[....1Y.A.".%..M..(h.Y..ms.B._x l.!p.....Vf...Kg.H..+~..<..<(-...MAB.V..].-x....T.?....b0.....s....G..0Fl..._8:...qP.u..(=...d....9.k..?.=4.R.....-.......1.R.Q..a.......Ao..+.....l.P.........O....,.`..C..,;.....<..m..zd.?.4q*..O:...E.Aa.._./...O.~....S>4.<...M..m#..3d...r|....S....*^..O[Xz.K...:...=.f..z......T.DB.p.,n..w.;...\.L...?8Fi....qU..#{.....'.a.....@L...A_foA.1<PO.9xQRe.......k...P.Z>_. ...8R....zZ..;I..NG?......o...O.X.n,........m..Q............M....z..v..F8.6...A....s+z.Kw...#f.......j.........b.Y]....F1.$.....:.....G..V#....M..L.G..K. ..F.p.K......w.x..-.L..Q.s..O. ...}..@.9..O".K..3.../......r#...Jq..v......W..0.9......N\*n.3......C..mJ.So.H.G.....+.J]....Tk......C........i.Q...9Whf..l..%6....TS`.....u..:.....=..z'3....@.c}.#.$p2@.;c.r3.^..`.:....^gb..aE..t.;3..._

                                                                        C:\Users\user\Desktop\IPKGELNTQY\PIVFAGEAAV.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860444313690256
                                                                        Encrypted:false
                                                                        SSDEEP:24:f5+IQh+qO/QUyQPV4PMLT86GTTgWLPJamnpn5CdG1EfGCzyZut1cTCJWbD:fkxMqOm6V40fBG1LPlsdG1EfjzcOWD
                                                                        MD5:26EC5D7CD79935E17B050983EC0F7A95
                                                                        SHA1:1F0A820EA005CAD44902EC1EF7D849260C1A2ED3
                                                                        SHA-256:5402219907DFD3AB460CE741312A21260383A15E0E904D3E80A43E47392737BC
                                                                        SHA-512:7F3D860686DDD1A0F7E46A7E47BC12DA854C394189321EBE08E12FAD81B74E6249965CB178168527F6175B41D8C8456F47CBDB31E3C743D397E7EA8119834204
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAr...c..F.......p?B..t.*.3.....Y...5eLt...b.P(...^.).{.q..Qt....+y./...Z+.c0..4l;^..P.#....3..3...>...&.p.....+.....@..t..M..H.\....FdT..M.......5i.1....g.i.V......z...*...2.....h.D}a.h6@....G.Gu..*.(..U..jT....J.%`..../..c...Bc...X.....*M...Q.h.8$=..ee.IG.-zh....(+...mW.x..o.....I.....3W.5..\..O.I.^..el.c'1..#:...W.o......z{...E:......^.0.&k...^..Jb^...ljp..o...s.eV.g..@.p..H..X.w9...@.IK.l..Q.."0."Z....(.n.=.b..T..~........`+...N.....\N.>.Vz...g.]u.`...e..q..d..v...$..?...^S./.0.,..V.%n....<v/.A............D...7..0'Ha......H.....{i`.L.....d... &..u{.Y..|.!`u....rfS...ny.w.W}.A.1...<.........Y...V.A..<.......IT...CA"..K.|.....+..#.C....g....i......%..}....P8....w=.4PY9t.8.!.D.....N.#}MgM.%.p..HM..2.,c}TU...:.v.B#...+!....2q / ...+.S..1.IS..9..G.@2...|wz..py.A.....K...H).]...!..w'q./..j..!w.......7..3.....7.rJ.r.Q..i*.^...../.............$v.....s.)i...).9..h.`&..`_..... .w4.*....,..`.....7..=..d.a{M.!..s..{\_..b.7.p.t. .UHV.k.H.

                                                                        C:\Users\user\Desktop\IPKGELNTQY\PIVFAGEAAV.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860444313690256
                                                                        Encrypted:false
                                                                        SSDEEP:24:f5+IQh+qO/QUyQPV4PMLT86GTTgWLPJamnpn5CdG1EfGCzyZut1cTCJWbD:fkxMqOm6V40fBG1LPlsdG1EfjzcOWD
                                                                        MD5:26EC5D7CD79935E17B050983EC0F7A95
                                                                        SHA1:1F0A820EA005CAD44902EC1EF7D849260C1A2ED3
                                                                        SHA-256:5402219907DFD3AB460CE741312A21260383A15E0E904D3E80A43E47392737BC
                                                                        SHA-512:7F3D860686DDD1A0F7E46A7E47BC12DA854C394189321EBE08E12FAD81B74E6249965CB178168527F6175B41D8C8456F47CBDB31E3C743D397E7EA8119834204
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAr...c..F.......p?B..t.*.3.....Y...5eLt...b.P(...^.).{.q..Qt....+y./...Z+.c0..4l;^..P.#....3..3...>...&.p.....+.....@..t..M..H.\....FdT..M.......5i.1....g.i.V......z...*...2.....h.D}a.h6@....G.Gu..*.(..U..jT....J.%`..../..c...Bc...X.....*M...Q.h.8$=..ee.IG.-zh....(+...mW.x..o.....I.....3W.5..\..O.I.^..el.c'1..#:...W.o......z{...E:......^.0.&k...^..Jb^...ljp..o...s.eV.g..@.p..H..X.w9...@.IK.l..Q.."0."Z....(.n.=.b..T..~........`+...N.....\N.>.Vz...g.]u.`...e..q..d..v...$..?...^S./.0.,..V.%n....<v/.A............D...7..0'Ha......H.....{i`.L.....d... &..u{.Y..|.!`u....rfS...ny.w.W}.A.1...<.........Y...V.A..<.......IT...CA"..K.|.....+..#.C....g....i......%..}....P8....w=.4PY9t.8.!.D.....N.#}MgM.%.p..HM..2.,c}TU...:.v.B#...+!....2q / ...+.S..1.IS..9..G.@2...|wz..py.A.....K...H).]...!..w'q./..j..!w.......7..3.....7.rJ.r.Q..i*.^...../.............$v.....s.)i...).9..h.`&..`_..... .w4.*....,..`.....7..=..d.a{M.!..s..{\_..b.7.p.t. .UHV.k.H.

                                                                        C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.864298744637212
                                                                        Encrypted:false
                                                                        SSDEEP:24:T3UV/OknrIlKHL3wCzty3bN6pL44BIpLByW9z5w+ksJ1rMfPXnnVeDLcoNobQWbD:TE1OecoHLfeM6pMo7JEXrQmD
                                                                        MD5:F16428318C1224140023FF585CD5F034
                                                                        SHA1:E73A29BC7470CE108339F48803EE4FD064FC1321
                                                                        SHA-256:6045B8DC642D5044DD312037F7C341283E2B09D4E1E342F5663DE7C6B8E10539
                                                                        SHA-512:581B824DDC1F12288929D9CA8C44F7A993F0D67B750ED5D9E44775A8E6614DDFEC64CCB29DDCF1CF618AE66F7B054991999D593B2EAA9B0952B23C753448E2E4
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:QCFWY..$.ye..n.d.....l@..c.."<J....5....Cy0S...........~......L...RM.#..D.JG..v/..Q...... ..mYW...\.....m.j^E.KKL..df...r1Z.........1..EA........d...g.0E.g....A....3y.l.....*...r.3..`.....3.!cngY......g.`..z.s........A:...:h6....J.*CU.I....{^.....l.#7t....N....O..n.W..=..J....X.......@..B(.....9.#.Vh[{....../!.".q.(%..\..EY.YG.Ldj........"..^...X'_........g...@./.9=..._.9*{.&...6....O.w.L\.N-.INH.......^.....0.&..Y....o..Y!^D&]...........o.....F..}p.4A;.5....eP"|...T.pK.....U..i..VM....T...._.#..q.+.a.n....%u..z7..P..cF....z....t..@...D;.9.U_...6)&....z.7..r..@..aozG|......O.t...OO..Ok.m.A.4b=[v.,q8.f.u...m....r...{.q... .@..@}..+..{_.......9H.....(.%.._2..~..L4....#.u.......rw..K".....7.......V.....M..~2^.r.g..........6J.h*ax.6.|A"%..q.K.SAy.|[<Q.'...e.M}.z..'..}...m;.....2.&$...:.\.........@.>t..6Y)`j..4n:.%...F...K|.....}..n.e..uXg..7@..VKX..........Z.X.'r<..../...G........ .S.[..W.V.;..b Z..\...!4.Q....[.=].s "..;JQD.v"...u6.E....~:...L.?q..

                                                                        C:\Users\user\Desktop\IPKGELNTQY\QCFWYSKMHA.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.864298744637212
                                                                        Encrypted:false
                                                                        SSDEEP:24:T3UV/OknrIlKHL3wCzty3bN6pL44BIpLByW9z5w+ksJ1rMfPXnnVeDLcoNobQWbD:TE1OecoHLfeM6pMo7JEXrQmD
                                                                        MD5:F16428318C1224140023FF585CD5F034
                                                                        SHA1:E73A29BC7470CE108339F48803EE4FD064FC1321
                                                                        SHA-256:6045B8DC642D5044DD312037F7C341283E2B09D4E1E342F5663DE7C6B8E10539
                                                                        SHA-512:581B824DDC1F12288929D9CA8C44F7A993F0D67B750ED5D9E44775A8E6614DDFEC64CCB29DDCF1CF618AE66F7B054991999D593B2EAA9B0952B23C753448E2E4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY..$.ye..n.d.....l@..c.."<J....5....Cy0S...........~......L...RM.#..D.JG..v/..Q...... ..mYW...\.....m.j^E.KKL..df...r1Z.........1..EA........d...g.0E.g....A....3y.l.....*...r.3..`.....3.!cngY......g.`..z.s........A:...:h6....J.*CU.I....{^.....l.#7t....N....O..n.W..=..J....X.......@..B(.....9.#.Vh[{....../!.".q.(%..\..EY.YG.Ldj........"..^...X'_........g...@./.9=..._.9*{.&...6....O.w.L\.N-.INH.......^.....0.&..Y....o..Y!^D&]...........o.....F..}p.4A;.5....eP"|...T.pK.....U..i..VM....T...._.#..q.+.a.n....%u..z7..P..cF....z....t..@...D;.9.U_...6)&....z.7..r..@..aozG|......O.t...OO..Ok.m.A.4b=[v.,q8.f.u...m....r...{.q... .@..@}..+..{_.......9H.....(.%.._2..~..L4....#.u.......rw..K".....7.......V.....M..~2^.r.g..........6J.h*ax.6.|A"%..q.K.SAy.|[<Q.'...e.M}.z..'..}...m;.....2.&$...:.\.........@.>t..6Y)`j..4n:.%...F...K|.....}..n.e..uXg..7@..VKX..........Z.X.'r<..../...G........ .S.[..W.V.;..b Z..\...!4.Q....[.=].s "..;JQD.v"...u6.E....~:...L.?q..

                                                                        C:\Users\user\Desktop\IPKGELNTQY\ZQIXMVQGAH.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.84278076344708
                                                                        Encrypted:false
                                                                        SSDEEP:24:icQlCZqJiehaHADIs/rLv6W7kPrEV2e99LrchXO6CetD3wA5tZueWbD:FKBJD5HvvkgAe9pj67woZSD
                                                                        MD5:D513B27A40E183358A65FE742D981165
                                                                        SHA1:C295A83EA52062D51916BC1E4038A913DB72FE51
                                                                        SHA-256:F2B084201D9A1F8FDB6ACA5203CBF02A9F49F22854AEA614CBFF13E75E99F944
                                                                        SHA-512:CFA22D48F34F03531616E9CA93C9AE60868EB639248523CCE965970311E6E8D1029169E09C8627B022AE3ABBF838B59ECC8A39260CAD2F5D2064FFBE5ED7BE95
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM..7.Z.S.WQl.i|bA..g!..!X.2..b.....b8..17.).*L.,...>I.~.j,.r..4.+@5...aX..HG@...K..V.Ltm}.Y.$[...#........23^fC...?xx..>/...<}^...g...g...../a...vb..6.R..w..)js...w..11....u]K..f.+.....5<)wq.<...U.m..SO...Xe...w.b.g..5..f.C....Kv...?...L.C......X...b.L#.U.U.F....M...+...tm.^..~........'...l...'O...$.|.S..<3...y....A...m...J(;+......T.!@[...qb..f..*2.(.....O.+l7.<x....3...[.......}.$..V}..!........tT%....P..].F.7.3X.S6.|_.i.r?..hn..F.)..11....R.....y.@.7nF..:]$.......$....q..;".3.$k.}m...p....?.(....H^.....i+..WlM..}W<...A.Fi..)lF1.T..6....1.p.p.5.`..........#...vL.J8L.4..:4.v.-fJ....X......to..p.E...x.%.Z.C.....67.9,..B.....N+Ts.9J*~Z.i]..>v/...>...l:.....;/...G.0..u=VE.p.N...}...=......5.b.f..h..7zh...7...&$.w"..':...#S..-POTT.....A...n"C..W..........G....Z...%U..m....Z.#o.#P.$U..V.4n.v@K....a.'. ..K...._4..'.......z..lxc.m...-..B...\.;..]j.p._].A...#~..&,..c.!.3.z?.W(=.Y....T.b.s.9.P6m.C. .....fQ..4Oh.V..>?.l-.F......f.yc.Hu.B...1.*.b.fZ..s7

                                                                        C:\Users\user\Desktop\IPKGELNTQY\ZQIXMVQGAH.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.84278076344708
                                                                        Encrypted:false
                                                                        SSDEEP:24:icQlCZqJiehaHADIs/rLv6W7kPrEV2e99LrchXO6CetD3wA5tZueWbD:FKBJD5HvvkgAe9pj67woZSD
                                                                        MD5:D513B27A40E183358A65FE742D981165
                                                                        SHA1:C295A83EA52062D51916BC1E4038A913DB72FE51
                                                                        SHA-256:F2B084201D9A1F8FDB6ACA5203CBF02A9F49F22854AEA614CBFF13E75E99F944
                                                                        SHA-512:CFA22D48F34F03531616E9CA93C9AE60868EB639248523CCE965970311E6E8D1029169E09C8627B022AE3ABBF838B59ECC8A39260CAD2F5D2064FFBE5ED7BE95
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM..7.Z.S.WQl.i|bA..g!..!X.2..b.....b8..17.).*L.,...>I.~.j,.r..4.+@5...aX..HG@...K..V.Ltm}.Y.$[...#........23^fC...?xx..>/...<}^...g...g...../a...vb..6.R..w..)js...w..11....u]K..f.+.....5<)wq.<...U.m..SO...Xe...w.b.g..5..f.C....Kv...?...L.C......X...b.L#.U.U.F....M...+...tm.^..~........'...l...'O...$.|.S..<3...y....A...m...J(;+......T.!@[...qb..f..*2.(.....O.+l7.<x....3...[.......}.$..V}..!........tT%....P..].F.7.3X.S6.|_.i.r?..hn..F.)..11....R.....y.@.7nF..:]$.......$....q..;".3.$k.}m...p....?.(....H^.....i+..WlM..}W<...A.Fi..)lF1.T..6....1.p.p.5.`..........#...vL.J8L.4..:4.v.-fJ....X......to..p.E...x.%.Z.C.....67.9,..B.....N+Ts.9J*~Z.i]..>v/...>...l:.....;/...G.0..u=VE.p.N...}...=......5.b.f..h..7zh...7...&$.w"..':...#S..-POTT.....A...n"C..W..........G....Z...%U..m....Z.#o.#P.$U..V.4n.v@K....a.'. ..K...._4..'.......z..lxc.m...-..B...\.;..]j.p._].A...#~..&,..c.!.3.z?.W(=.Y....T.b.s.9.P6m.C. .....fQ..4Oh.V..>?.l-.F......f.yc.Hu.B...1.*.b.fZ..s7

                                                                        C:\Users\user\Desktop\LSBIHQFDVT.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.866273674664746
                                                                        Encrypted:false
                                                                        SSDEEP:24:KCwgNMPN2CHaxKmuOe9nHglrOModjZjwBZZ4lI2LWc5TdQ4Tf5P1j3T6tsFMaJWX:KheMF6uOiUOhxs6lxLWm5vf5P1csFhWD
                                                                        MD5:AF2AD5B69EF5D8891A4D80F67D519123
                                                                        SHA1:8B21B1B26AA8FD801238E7F48FE71DF953733987
                                                                        SHA-256:B6E9CF19654AC28B7F6EE0C2D27E81C8CCB6AA1A2A7DB5EFB2A581FDCF4B7B56
                                                                        SHA-512:8921EB36E88D6B3C77BD92FB8632DE4F334B5AB546D5B9A13233C0A298D44CF29B3C40D3B007EAE6506373C816CF9957086F91081573FEF27E61A16B986201BE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIHwk.X..f...[.N(../.iID|.t._........ .....cPp=.<...V......C(......;..._..y.5I0..i.'z..~.y.f.;n-r...A.qa.7I..P.f.1.v.^.C..Ll.L........Y....C@.....a.N...~....x.IDU9....O....x....S....N.9......h.!M..0b......L....n.Ng0..b.Xt<..,.K"s..d\...".2._../}go.I9&..E.m.l.BgKX..37...J.."|I.]G.`....._....k..vv;G... ...'..YMa....{.|.d..u..|.7.*..?AX..}.^xm.c.l..e...7..Q.R.e..3IP...J@`=.cH......:i.:....@G.-s.."3..}Y..:#..-.0..1..W. ...M....s..q&v8u.J&..h:e..e.C....^.)B..P....0L..k.]...r......}.[.s.............#.C.k..R|B.N~L..{`...Cr.(.+...(D%e.".W=.;Y....Tj'<.N.\s..6...P...#.*.f......B,v.....m.b.S.%......g....$..[........d.../E..Zpf.`...e.>{/.....k...5.g~../.H&....Z8....WJm....j{N~..1..Gy.Yp-,...)............-..n?....4..N......E.S/_.\A...s.m.D"U`2.l'.@q.V..a.O...N...[..K..KJO...-.>.a.<.Kqt'.k....R.F...5.2qS...=.[Z...N1.u.# -o.~....)......7.Bc....wc...V...5........<.<..M.....|uA@..].].}n..|..IK...=&S)..?_.TX.`.s$...H.b]........9I.&a...<L.t.0..u...=.u.kj..1...k.

                                                                        C:\Users\user\Desktop\LSBIHQFDVT.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.866273674664746
                                                                        Encrypted:false
                                                                        SSDEEP:24:KCwgNMPN2CHaxKmuOe9nHglrOModjZjwBZZ4lI2LWc5TdQ4Tf5P1j3T6tsFMaJWX:KheMF6uOiUOhxs6lxLWm5vf5P1csFhWD
                                                                        MD5:AF2AD5B69EF5D8891A4D80F67D519123
                                                                        SHA1:8B21B1B26AA8FD801238E7F48FE71DF953733987
                                                                        SHA-256:B6E9CF19654AC28B7F6EE0C2D27E81C8CCB6AA1A2A7DB5EFB2A581FDCF4B7B56
                                                                        SHA-512:8921EB36E88D6B3C77BD92FB8632DE4F334B5AB546D5B9A13233C0A298D44CF29B3C40D3B007EAE6506373C816CF9957086F91081573FEF27E61A16B986201BE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIHwk.X..f...[.N(../.iID|.t._........ .....cPp=.<...V......C(......;..._..y.5I0..i.'z..~.y.f.;n-r...A.qa.7I..P.f.1.v.^.C..Ll.L........Y....C@.....a.N...~....x.IDU9....O....x....S....N.9......h.!M..0b......L....n.Ng0..b.Xt<..,.K"s..d\...".2._../}go.I9&..E.m.l.BgKX..37...J.."|I.]G.`....._....k..vv;G... ...'..YMa....{.|.d..u..|.7.*..?AX..}.^xm.c.l..e...7..Q.R.e..3IP...J@`=.cH......:i.:....@G.-s.."3..}Y..:#..-.0..1..W. ...M....s..q&v8u.J&..h:e..e.C....^.)B..P....0L..k.]...r......}.[.s.............#.C.k..R|B.N~L..{`...Cr.(.+...(D%e.".W=.;Y....Tj'<.N.\s..6...P...#.*.f......B,v.....m.b.S.%......g....$..[........d.../E..Zpf.`...e.>{/.....k...5.g~../.H&....Z8....WJm....j{N~..1..Gy.Yp-,...)............-..n?....4..N......E.S/_.\A...s.m.D"U`2.l'.@q.V..a.O...N...[..K..KJO...-.>.a.<.Kqt'.k....R.F...5.2qS...=.[Z...N1.u.# -o.~....)......7.Bc....wc...V...5........<.<..M.....|uA@..].].}n..|..IK...=&S)..?_.TX.`.s$...H.b]........9I.&a...<L.t.0..u...=.u.kj..1...k.

                                                                        C:\Users\user\Desktop\MXPXCVPDVN.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.851208933934614
                                                                        Encrypted:false
                                                                        SSDEEP:24:Tm4/Hs3BYRUxPiyutGH6N3sKt2a9Enyd2TxQgBU02rON333dUTMWbD:Tm4/2SRUxaptqu2+dkxdBUJw3n6TRD
                                                                        MD5:46FADCB38B00DE40F1A47F11B9872432
                                                                        SHA1:DF48EE2EA1CD45DDB87BB93D9A6DE8D5629FBACA
                                                                        SHA-256:B8BBDE43D4BE13650379DBE9D93E1BBF376D551FA255FA24F933A51B125EC63B
                                                                        SHA-512:13A32C08B204DF2C957F55AD677789198AF7C46213725A35C198BEE51C820F6250E4BEC1842F49C5F93973458AD15FEDA8C606278A86D300A243715B4C5F4F2F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC....2...G..D.:4.J.rx{...U.^.T.q..d...B}..N...t.[..p2.k!..?L:..2..r......^...R.[..bJ..s..+.h.Yj..#.H..d......"=i...Y...c.7-.K.lV..,......=.lh...Q>.9.}......'..>.3.jO.....K.._.z.' .b..(...Uv..>...`k........"..f....p.+..LiL.B...c......4..g.".C.5o..6..]-.h:.a.5't...TI...\...]...&......G....EoU.....'^f...N...j:.....G...;j_..../S.8G6PW.0..e..BG.},'C.WQ.'..l..j.#!~z.)>w..]...[.zNh..T.[W#..aQ...w......|.YA.....i.)=..X.....V3....v.%.).q....XP.W.{E....@....%.cN..A..@4.....sY..U9..V+7..l.@.z",g.u.K.............X.........3...oaz.R..-.!2M+...(.~(JL..Tx.TU...2..I'.....@.........o#J..,G_l.T........q...y.[im;...at..~zr...D....L}u Y..:c/..-.>d..]..\...0....b....F...S......P.#-.-.P?..r..fh[...6cY.j.B.&n0..65.V...'.BXO..".p.5{.$.w..F.k.bb.<.......&}.R0+..c.P....dm..)..K.sq.....zw}p..AQ.\1.R*.'..EA:.P(y..%......z..}..e..+.k.D....Wd.b..,._..P......[/<.~.........o/%H.n..j.x......+..kf...Wp=.,`.:k..I.......HJ.....j.M..Y.....p.E...nF.ssc=R...`

                                                                        C:\Users\user\Desktop\MXPXCVPDVN.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.851208933934614
                                                                        Encrypted:false
                                                                        SSDEEP:24:Tm4/Hs3BYRUxPiyutGH6N3sKt2a9Enyd2TxQgBU02rON333dUTMWbD:Tm4/2SRUxaptqu2+dkxdBUJw3n6TRD
                                                                        MD5:46FADCB38B00DE40F1A47F11B9872432
                                                                        SHA1:DF48EE2EA1CD45DDB87BB93D9A6DE8D5629FBACA
                                                                        SHA-256:B8BBDE43D4BE13650379DBE9D93E1BBF376D551FA255FA24F933A51B125EC63B
                                                                        SHA-512:13A32C08B204DF2C957F55AD677789198AF7C46213725A35C198BEE51C820F6250E4BEC1842F49C5F93973458AD15FEDA8C606278A86D300A243715B4C5F4F2F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC....2...G..D.:4.J.rx{...U.^.T.q..d...B}..N...t.[..p2.k!..?L:..2..r......^...R.[..bJ..s..+.h.Yj..#.H..d......"=i...Y...c.7-.K.lV..,......=.lh...Q>.9.}......'..>.3.jO.....K.._.z.' .b..(...Uv..>...`k........"..f....p.+..LiL.B...c......4..g.".C.5o..6..]-.h:.a.5't...TI...\...]...&......G....EoU.....'^f...N...j:.....G...;j_..../S.8G6PW.0..e..BG.},'C.WQ.'..l..j.#!~z.)>w..]...[.zNh..T.[W#..aQ...w......|.YA.....i.)=..X.....V3....v.%.).q....XP.W.{E....@....%.cN..A..@4.....sY..U9..V+7..l.@.z",g.u.K.............X.........3...oaz.R..-.!2M+...(.~(JL..Tx.TU...2..I'.....@.........o#J..,G_l.T........q...y.[im;...at..~zr...D....L}u Y..:c/..-.>d..]..\...0....b....F...S......P.#-.-.P?..r..fh[...6cY.j.B.&n0..65.V...'.BXO..".p.5{.$.w..F.k.bb.<.......&}.R0+..c.P....dm..)..K.sq.....zw}p..AQ.\1.R*.'..EA:.P(y..%......z..}..e..+.k.D....Wd.b..,._..P......[/<.~.........o/%H.n..j.x......+..kf...Wp=.,`.:k..I.......HJ.....j.M..Y.....p.E...nF.ssc=R...`

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\IPKGELNTQY.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.870645147483846
                                                                        Encrypted:false
                                                                        SSDEEP:24:0F17wq1BlD0XQrDUetIHKI4NdpOVu0GwGunbADMF5zsnCJWbD:0F1kq9D2QfUg1IWJ0lGun6M3snCWD
                                                                        MD5:64B01D6A0BD43E648EEBC43320584A1C
                                                                        SHA1:818C8379F8EA0CB9B2B2795418516BE9018E75F8
                                                                        SHA-256:BE4DCDA7CFA08EFEBD226CD1B98DACD478CB428D73184618F90E5E7BB3D4BB6D
                                                                        SHA-512:9127A460AD9CCD18D135C1BC07C12010CFCF6221D1BD22916CBB79CF194FCC47580B83804D593D8301BA41CC73FDC6896FE94B3CB175E296716B2744E6434835
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.-YU1a..c.'.L;...4^>.0.............c.h......MgN.l...Rz:N3...F.!..5G.....i...I.61...1.q.......@..q.J. O........&..#...,......t.SH...W........W.a....i..........?...............P...J.4Q...S...G.2..@.5...s=..D./H$.|.......2.6/..S.....=...e.D......F+,...Y.{aX+..6..xf}.c.%T.4W..`_...c.Z.O..)k:...EM0.^b.d))...qA....x.....J...r...v.. .J.K85.]MV.^...|f...v8......._..5.2i....n...4s`.8X....c.e!"C...a..K...E..].9..#.8t.P..UOU.<....Q..D.".Q..y.pT........TQ6.&k.W.E.a..^.Yg.....".../$PM.:my..j..b..0[.ok...h.T...<M......H..bV..Y.C.>yi.IV....cs...#o.bM........2.u=Q...6...n.U.x........JM.y.ALp.B.....g.c..\.-..X..".0....R.Q.70h.'......o......pH|.O..cN.Yz..K..>.0.W.l.p..O7g..N..2....M>...t..L0..0...h...$^.t..... ..~..............,..=..n .........]Ip.].....]..u.....v.{....B......f..g...9.[......<w..RK...I.)7l...D...a5......#...s...E.z`.N..Q...-....}.~].....\U'..Z"......w...4J@px...w.....5....b..n..*...S}58....(M.bcqH.Q...M..8.7...J.E(2.

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\IPKGELNTQY.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.870645147483846
                                                                        Encrypted:false
                                                                        SSDEEP:24:0F17wq1BlD0XQrDUetIHKI4NdpOVu0GwGunbADMF5zsnCJWbD:0F1kq9D2QfUg1IWJ0lGun6M3snCWD
                                                                        MD5:64B01D6A0BD43E648EEBC43320584A1C
                                                                        SHA1:818C8379F8EA0CB9B2B2795418516BE9018E75F8
                                                                        SHA-256:BE4DCDA7CFA08EFEBD226CD1B98DACD478CB428D73184618F90E5E7BB3D4BB6D
                                                                        SHA-512:9127A460AD9CCD18D135C1BC07C12010CFCF6221D1BD22916CBB79CF194FCC47580B83804D593D8301BA41CC73FDC6896FE94B3CB175E296716B2744E6434835
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.-YU1a..c.'.L;...4^>.0.............c.h......MgN.l...Rz:N3...F.!..5G.....i...I.61...1.q.......@..q.J. O........&..#...,......t.SH...W........W.a....i..........?...............P...J.4Q...S...G.2..@.5...s=..D./H$.|.......2.6/..S.....=...e.D......F+,...Y.{aX+..6..xf}.c.%T.4W..`_...c.Z.O..)k:...EM0.^b.d))...qA....x.....J...r...v.. .J.K85.]MV.^...|f...v8......._..5.2i....n...4s`.8X....c.e!"C...a..K...E..].9..#.8t.P..UOU.<....Q..D.".Q..y.pT........TQ6.&k.W.E.a..^.Yg.....".../$PM.:my..j..b..0[.ok...h.T...<M......H..bV..Y.C.>yi.IV....cs...#o.bM........2.u=Q...6...n.U.x........JM.y.ALp.B.....g.c..\.-..X..".0....R.Q.70h.'......o......pH|.O..cN.Yz..K..>.0.W.l.p..O7g..N..2....M>...t..L0..0...h...$^.t..... ..~..............,..=..n .........]Ip.].....]..u.....v.{....B......f..g...9.[......<w..RK...I.)7l...D...a5......#...s...E.z`.N..Q...-....}.~].....\U'..Z"......w...4J@px...w.....5....b..n..*...S}58....(M.bcqH.Q...M..8.7...J.E(2.

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\LSBIHQFDVT.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8302705450616665
                                                                        Encrypted:false
                                                                        SSDEEP:24:K2FiF/BByOUGfUrqYLaSIiFbFFWEoq6Edaoa+WbD:Kj5BTUoUhIMFFWtEY7D
                                                                        MD5:954CD497662EFEA8B9CD6BEEA2D84FB0
                                                                        SHA1:82F54E1404C3B715B7E43E561AB069457F195E23
                                                                        SHA-256:62E967BB1D3D00CAECD6090EE6828450A0D8FA55C5F7860FAAC676C83517FAC3
                                                                        SHA-512:7FC0A58F0C57DD2D7D3E2D5945B674C733694517D5DF05F108C074116FB590342AA197D5DF286D4FEDE82173EAAFE7C3D000DAE407A241ABEAC57B74BFC2D99F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIH.2.))...*1...w.....V....3..F....y}...E.r.<..1c.,.j..!?......lk.......pp......G...(...c..!?.9...5LX..p^...p.].3 lK.y..i.^......+6,Z8.c.:...Zc.......'.u.D.._'_X.z.....Y....A.G....}......{....|K.......A..2....m......#Vu.../r.........K.....s.UP[......@)W..&Vj..q..IP.l9..n.d(%L.-,..D..+i.05..[.Y....c..OCW.y....[.....'..w2[).f........,.>.0T......o..U...1.....3^7LW...h.ln..#.i.n..]tg7.Rlj.......Sz.....q.A......d.....K .d..}?.....7O......'h.JF..b.km.........y......m:....!.Q.).9...].:.....K.LH..ph.....d.I......<-veUDh..#....|m.{g.e..cF4.g.3...o*.F.+.7.O..Vo......y..9.4XGy..x).....S')..U..O.....-..u5....MO..T...u_U...6.a.#...kG~ T2.Gd.5..Vo5J{*...Q..b.ty.'...G..).#.{......L..n?'..[+.Q.cf..*.H....`.....N.k...\...C...m...`....q....j.e..*A3&'........F...../...pl.?F.zn...7T..BT...c.......n.%.....X..\.8...V.hz..&f9.w&_.0.>t2.t~1D.Q...0mT..}...m..S4M.!M.|>.wlG.K.*.7....R......8..._.....'.e..'.f...rV...).{.&_.8]2.'O....bvVo.....g..>.#.s..u.3...v..<.H.^..ZH3.....

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\LSBIHQFDVT.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8302705450616665
                                                                        Encrypted:false
                                                                        SSDEEP:24:K2FiF/BByOUGfUrqYLaSIiFbFFWEoq6Edaoa+WbD:Kj5BTUoUhIMFFWtEY7D
                                                                        MD5:954CD497662EFEA8B9CD6BEEA2D84FB0
                                                                        SHA1:82F54E1404C3B715B7E43E561AB069457F195E23
                                                                        SHA-256:62E967BB1D3D00CAECD6090EE6828450A0D8FA55C5F7860FAAC676C83517FAC3
                                                                        SHA-512:7FC0A58F0C57DD2D7D3E2D5945B674C733694517D5DF05F108C074116FB590342AA197D5DF286D4FEDE82173EAAFE7C3D000DAE407A241ABEAC57B74BFC2D99F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIH.2.))...*1...w.....V....3..F....y}...E.r.<..1c.,.j..!?......lk.......pp......G...(...c..!?.9...5LX..p^...p.].3 lK.y..i.^......+6,Z8.c.:...Zc.......'.u.D.._'_X.z.....Y....A.G....}......{....|K.......A..2....m......#Vu.../r.........K.....s.UP[......@)W..&Vj..q..IP.l9..n.d(%L.-,..D..+i.05..[.Y....c..OCW.y....[.....'..w2[).f........,.>.0T......o..U...1.....3^7LW...h.ln..#.i.n..]tg7.Rlj.......Sz.....q.A......d.....K .d..}?.....7O......'h.JF..b.km.........y......m:....!.Q.).9...].:.....K.LH..ph.....d.I......<-veUDh..#....|m.{g.e..cF4.g.3...o*.F.+.7.O..Vo......y..9.4XGy..x).....S')..U..O.....-..u5....MO..T...u_U...6.a.#...kG~ T2.Gd.5..Vo5J{*...Q..b.ty.'...G..).#.{......L..n?'..[+.Q.cf..*.H....`.....N.k...\...C...m...`....q....j.e..*A3&'........F...../...pl.?F.zn...7T..BT...c.......n.%.....X..\.8...V.hz..&f9.w&_.0.>t2.t~1D.Q...0mT..}...m..S4M.!M.|>.wlG.K.*.7....R......8..._.....'.e..'.f...rV...).{.&_.8]2.'O....bvVo.....g..>.#.s..u.3...v..<.H.^..ZH3.....

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.868003990253217
                                                                        Encrypted:false
                                                                        SSDEEP:24:KiJYzTW+C/hY4jjcr05FLzbTGlikCT6NGQmnVgSMD2R+5VGPeKkvL4LbyWbD:KqkTmZYOjcr05FLxkPGQmCSrRgVGGvMz
                                                                        MD5:6F115103EEA44BAE30424815CEF9A300
                                                                        SHA1:8A21BD4338B8369DB920D883A508C5D07E72C254
                                                                        SHA-256:0F757BB57643CE31F5119BEB1844784289721EEFAA50A4B1D567EC1B096BBB5B
                                                                        SHA-512:AF70F10BDECBC61053AD4E3E954FEDD556FD9606BF454011C971C0F6FD8AEBC62407B116B87A20BAE57DD2BDC64735E209EC89FB74EDC3890AB3D8BAA4571E64
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MXPXC...;C......... .U.(m.....3..q).h~`....{.....a..n.;>.~.^k........."6 ..)..8....'U4Z.K..9t4z......>....ph>/Q....T.i...Ha...`w.g.$....<..\.9.m...=.5..6.........y........Xa.AE.!Y.....SvuG..z...,....6%Y..q....4d.UI._y.o.'.....;....7......X.{Z..y.......F........].....?jS.*:_z..\X.........B..>.=.]F..c..D.0>m.`..<h..-..?5.&.......4X.{......,....w...r@0,H...}PE.g...u".n.A......N......>R3,.....w......J..qF.k.u....b...4.C..}B.d.1...*g.=>.......n,8.t.....ia.2..D...e+b%...>F.H.sO....y&..I.5....v^W....._.Si..D....B.10........zd.hq..^....".F.5....ES.........:"...kcC..ElYS...8...w.$d...U.j,...;+...c..S.....WZ.#5O.:.22...X..u.l.,G...>.N%...3tI ...c..1@a...ZG...a..|....f..F..H...][.r..`....c...P:7.}&..Mv........R{...T..p.......ne. 8Z+.M."..l...+Q.....O7.h....K....ZC...!A.M....S..`..m.G,.&Q.j.S-y4...G.Q.Q..)...........t.&Lo........3.........B....?..'.....;*./.]....Z.c.zM..wu...........u.....+.J.n..=T0e2..t...........oc=xT|........

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\MXPXCVPDVN.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.868003990253217
                                                                        Encrypted:false
                                                                        SSDEEP:24:KiJYzTW+C/hY4jjcr05FLzbTGlikCT6NGQmnVgSMD2R+5VGPeKkvL4LbyWbD:KqkTmZYOjcr05FLxkPGQmCSrRgVGGvMz
                                                                        MD5:6F115103EEA44BAE30424815CEF9A300
                                                                        SHA1:8A21BD4338B8369DB920D883A508C5D07E72C254
                                                                        SHA-256:0F757BB57643CE31F5119BEB1844784289721EEFAA50A4B1D567EC1B096BBB5B
                                                                        SHA-512:AF70F10BDECBC61053AD4E3E954FEDD556FD9606BF454011C971C0F6FD8AEBC62407B116B87A20BAE57DD2BDC64735E209EC89FB74EDC3890AB3D8BAA4571E64
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC...;C......... .U.(m.....3..q).h~`....{.....a..n.;>.~.^k........."6 ..)..8....'U4Z.K..9t4z......>....ph>/Q....T.i...Ha...`w.g.$....<..\.9.m...=.5..6.........y........Xa.AE.!Y.....SvuG..z...,....6%Y..q....4d.UI._y.o.'.....;....7......X.{Z..y.......F........].....?jS.*:_z..\X.........B..>.=.]F..c..D.0>m.`..<h..-..?5.&.......4X.{......,....w...r@0,H...}PE.g...u".n.A......N......>R3,.....w......J..qF.k.u....b...4.C..}B.d.1...*g.=>.......n,8.t.....ia.2..D...e+b%...>F.H.sO....y&..I.5....v^W....._.Si..D....B.10........zd.hq..^....".F.5....ES.........:"...kcC..ElYS...8...w.$d...U.j,...;+...c..S.....WZ.#5O.:.22...X..u.l.,G...>.N%...3tI ...c..1@a...ZG...a..|....f..F..H...][.r..`....c...P:7.}&..Mv........R{...T..p.......ne. 8Z+.M."..l...+Q.....O7.h....K....ZC...!A.M....S..`..m.G,.&Q.j.S-y4...G.Q.Q..)...........t.&Lo........3.........B....?..'.....;*./.]....Z.c.zM..wu...........u.....+.J.n..=T0e2..t...........oc=xT|........

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\NEBFQQYWPS.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8489157265520975
                                                                        Encrypted:false
                                                                        SSDEEP:24:DkuUy2GVVMpDudWNSDaoNXrI3H3XFYtYQMJmsa+LWKP0XOrgp87Wf8WbD:beGjMJud+SDfVI3XXFYmPJm0LWH+8p8g
                                                                        MD5:47CB8629AD2F50E0C12973804A1A1BD1
                                                                        SHA1:E5F2FB556D29D760EB52ABDC04802EB1B6435655
                                                                        SHA-256:E37DCD38D38BFB91244D024D1421EC5644D3C83159CAFF26240562EC1B5A7049
                                                                        SHA-512:6A6E1CF7FC705A849F4892AE096A22E4CA5927BFDBBD88309306EB98A21CA25695B5279AF2F166B50B336DC959A1B663AA9334B63C5B1AA97A1EC18197A50A85
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:NEBFQ#.....*....=..{0{.....:....GHO*L3O/.`......D.A...(..6...h.....o+....fwPu....X.......@...X..D.2..AR>...bjN.1.X.".(..sdt...,.~.n'.v..R.[x.j...k.$g..d........5,-.P......1..?.#..............@L.B.!....[...^.j.q.mQP.K$...Z...>.f.!Y?.!...9..)Z5.....E....N......M..u....C....u.p.#.W.q.lA.sq....._.y....\....N..E..W.!2.82Y+..wf...sG..EH..V.f.l..m8..c.}..iG$n.~p0..m.....*....8...1.w...p-....;-.}?Q...x45......a.(,.cc7.g..g.X....b ..p...b.RdIO...i..N..U..k$~.G.b=b...&..W.|&..n...W,...?..3...D.03=>.F......5fR.._H`.*.5^..t'......kL~....:Ky...b..{...K&.>..S.4.u.B..t....N#....8.%.q...;.m.....aR.?e.b.N.F/.......*.^....)<.I.%=.....gA$.Q...%...v........P..c1...$..o.\[..'.$...7...`...Mh.s.d.c@?.c._E........:....T..w.s..C.G2:...%/>..w....6..7.~.W..q~n]..MD.s...n.fn`*.^..^..M.^B..%....R..2.BF\w;.?...C..@W].!....._..Xy...1.....I..#f.!>(.A......K!B..O'......[o..ZN..W..Ww.1.../.+..R.%,....d..Z..w.s.Zz-.1..1..5..\.b.C...z...A....xd...).=;<.U.w!.N.d:

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\NEBFQQYWPS.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8489157265520975
                                                                        Encrypted:false
                                                                        SSDEEP:24:DkuUy2GVVMpDudWNSDaoNXrI3H3XFYtYQMJmsa+LWKP0XOrgp87Wf8WbD:beGjMJud+SDfVI3XXFYmPJm0LWH+8p8g
                                                                        MD5:47CB8629AD2F50E0C12973804A1A1BD1
                                                                        SHA1:E5F2FB556D29D760EB52ABDC04802EB1B6435655
                                                                        SHA-256:E37DCD38D38BFB91244D024D1421EC5644D3C83159CAFF26240562EC1B5A7049
                                                                        SHA-512:6A6E1CF7FC705A849F4892AE096A22E4CA5927BFDBBD88309306EB98A21CA25695B5279AF2F166B50B336DC959A1B663AA9334B63C5B1AA97A1EC18197A50A85
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ#.....*....=..{0{.....:....GHO*L3O/.`......D.A...(..6...h.....o+....fwPu....X.......@...X..D.2..AR>...bjN.1.X.".(..sdt...,.~.n'.v..R.[x.j...k.$g..d........5,-.P......1..?.#..............@L.B.!....[...^.j.q.mQP.K$...Z...>.f.!Y?.!...9..)Z5.....E....N......M..u....C....u.p.#.W.q.lA.sq....._.y....\....N..E..W.!2.82Y+..wf...sG..EH..V.f.l..m8..c.}..iG$n.~p0..m.....*....8...1.w...p-....;-.}?Q...x45......a.(,.cc7.g..g.X....b ..p...b.RdIO...i..N..U..k$~.G.b=b...&..W.|&..n...W,...?..3...D.03=>.F......5fR.._H`.*.5^..t'......kL~....:Ky...b..{...K&.>..S.4.u.B..t....N#....8.%.q...;.m.....aR.?e.b.N.F/.......*.^....)<.I.%=.....gA$.Q...%...v........P..c1...$..o.\[..'.$...7...`...Mh.s.d.c@?.c._E........:....T..w.s..C.G2:...%/>..w....6..7.~.W..q~n]..MD.s...n.fn`*.^..^..M.^B..%....R..2.BF\w;.?...C..@W].!....._..Xy...1.....I..#f.!>(.A......K!B..O'......[o..ZN..W..Ww.1.../.+..R.%,....d..Z..w.s.Zz-.1..1..5..\.b.C...z...A....xd...).=;<.U.w!.N.d:

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\SFPUSAFIOL.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.843589507754328
                                                                        Encrypted:false
                                                                        SSDEEP:24:z1+wl+eLxNjEOOXJHDuJ8+RXyt7MBYafr1+gniF6rcb8SGGdG2OEvioSTMKJWbD:z11l+e1NjEpjuJPW74fr1AGcb9VLOEvJ
                                                                        MD5:2EAD7BF4EC65B09568A45FC79DA1C655
                                                                        SHA1:2187099F1DA05378DC79B9D23079C04D2E0DC63A
                                                                        SHA-256:6BEED12505C68E42CD88FEA8F6DA208B109B91856FFDABE259979F4CEA0D3381
                                                                        SHA-512:319EB2DDCDB0765A1EDEB748DE60E6CB667BA14B96B0E7770EFF89DEC049912A23303A40A8595403C966CB26ED4280DAD682DEF2371F41A4C918090E856CEDCE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS*rm.....E.$.h..+.......Cu..{..K.;@....b..........kJ+0.c$...l....l...*.....1.F.s..}.....Y.....D;.F...6.90..y20.u.}..VL.@.v_>e.I....5Da...E.....6.N...Q.].9t...3..|.3|..h.."..6..m..5...&...H. Q.5tW+u..C....(.o.......g..S!.6..R...nt...m..U.\*..n.....o.Tb...".c{d..DAS3C,.=....}.T....D..vM.....A...y.J#?qQ/...!O.x./L..'A.6.f.I4@.h.r...H.df.g..xiZ..h.....%n.Wu.)...!..H.l.!...U...47~...v!..*c"E....K.1Zr:.Y.!k.5&/]...........~..K.6...jB.......)...\.h..i.(..A]e..?Y/.B5.+....(..t{.}..ba{_....K.o..Ml.-..O...R(.../....''....=........'....L .A[e...{.j.th..N.:........]*..}YI..$.&.T.hdOY..1i.../U.......`.7....?.%...........n=..!G..O..y..c.?...+H..Wc$...}.r....7.n....!.1..;....W....E.g.l..EZ.{.I.....T.....u..*....Tv..T.{:.^.....F..#.GL....].\.u..Z^Vn.."'eg..!\ ..sN.|.....J.~..8`u0.[.B#l3....9.8.S....n=....|..........$9......Ac\..&..g.R..I.eQ..xS1..D0.....4..f..e:..:.s...J..J.J.^IZ..iNN.'.7^.H%]...A$.Z.)/|;<..am).xc=?..)...%&.3yTj=D._:...eB.......

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\SFPUSAFIOL.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.843589507754328
                                                                        Encrypted:false
                                                                        SSDEEP:24:z1+wl+eLxNjEOOXJHDuJ8+RXyt7MBYafr1+gniF6rcb8SGGdG2OEvioSTMKJWbD:z11l+e1NjEpjuJPW74fr1AGcb9VLOEvJ
                                                                        MD5:2EAD7BF4EC65B09568A45FC79DA1C655
                                                                        SHA1:2187099F1DA05378DC79B9D23079C04D2E0DC63A
                                                                        SHA-256:6BEED12505C68E42CD88FEA8F6DA208B109B91856FFDABE259979F4CEA0D3381
                                                                        SHA-512:319EB2DDCDB0765A1EDEB748DE60E6CB667BA14B96B0E7770EFF89DEC049912A23303A40A8595403C966CB26ED4280DAD682DEF2371F41A4C918090E856CEDCE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS*rm.....E.$.h..+.......Cu..{..K.;@....b..........kJ+0.c$...l....l...*.....1.F.s..}.....Y.....D;.F...6.90..y20.u.}..VL.@.v_>e.I....5Da...E.....6.N...Q.].9t...3..|.3|..h.."..6..m..5...&...H. Q.5tW+u..C....(.o.......g..S!.6..R...nt...m..U.\*..n.....o.Tb...".c{d..DAS3C,.=....}.T....D..vM.....A...y.J#?qQ/...!O.x./L..'A.6.f.I4@.h.r...H.df.g..xiZ..h.....%n.Wu.)...!..H.l.!...U...47~...v!..*c"E....K.1Zr:.Y.!k.5&/]...........~..K.6...jB.......)...\.h..i.(..A]e..?Y/.B5.+....(..t{.}..ba{_....K.o..Ml.-..O...R(.../....''....=........'....L .A[e...{.j.th..N.:........]*..}YI..$.&.T.hdOY..1i.../U.......`.7....?.%...........n=..!G..O..y..c.?...+H..Wc$...}.r....7.n....!.1..;....W....E.g.l..EZ.{.I.....T.....u..*....Tv..T.{:.^.....F..#.GL....].\.u..Z^Vn.."'eg..!\ ..sN.|.....J.~..8`u0.[.B#l3....9.8.S....n=....|..........$9......Ac\..&..g.R..I.eQ..xS1..D0.....4..f..e:..:.s...J..J.J.^IZ..iNN.'.7^.H%]...A$.Z.)/|;<..am).xc=?..)...%&.3yTj=D._:...eB.......

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\ZQIXMVQGAH.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.833933426178924
                                                                        Encrypted:false
                                                                        SSDEEP:24:ff6cCEDoN5LlRM0mYnnzWKCOZGOIfFdUhQValNpgKMpRDyTqCIWbD:ff6aob6YnzUOzQVYgfTDyTq+D
                                                                        MD5:68D9CE1FB803997656A318CB361E7A4B
                                                                        SHA1:9D52E6CB5AE3D250A5477855818FCDFB843164FA
                                                                        SHA-256:46540995303EDA1B6CD801A2D6975735446A878F937D93A4EF9DFF0CD0041F6E
                                                                        SHA-512:E9CF1631B824B47EDB175F144115D2BE2667301B6BD5153387258F5AF934DDCAE913A7FB8087824B27038946A5B8F2E53B9C5B94EE2C5EE455F37B7F9BD7B09F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.<C.....v...R...1qV..h.tMZ.....O........w...Qf....QLL/Y-'.....J...:...wd|..K..O.....a........'.[..R..^..GX.@..V.Q..f.UR.*.V....j..)...P.|..kafD>..Z........R.A5k.......X..03..H<.N..".+.~bE..e`.FE~..w&...0....p..V.|.e....&E#.,P.u.%...i..<.3.E.....N......<.a..&mtpZ.8':..t...=cU.........S&...,(....L.U..A'.B(.[...j....T.....r..Z.u.....C....t..M....9N.....g../....|o...).'.o..........|..&............;.{J/..C..F.r....tO\.%l.O...~..x%)M........"w........w.K...ko..$.c~.6_.........[B.....C..r.......N..T...6J.@.+....u/.7.YU..}.k6T..Wr..L.5m.u...nb............2T#..9..|g...H..#N..j.Yj..!.w~.....^.....q8.....#8Jy.Oq..=..R........8)..2.Sel'.L..Y...RW..*...eG.;\.\..?A._.....!....:..Mi.6.j..q..^.B.l.X.j.Q.r...&N~O.[!|.......Q....%-.2RNk6L....V~;.4Qw.o]j.....9...=.v.!...^G.>.6".{>..o.I.W;.v./.C....+...Q..2..&./.s...}o3S<.y^[.d....Ex....c.8...u.0.....QNMm..3.......}.\....Y...5()..S.....y3....#O..Z..!?-.~.....S........E......p...%9.X.ij..

                                                                        C:\Users\user\Desktop\MXPXCVPDVN\ZQIXMVQGAH.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.833933426178924
                                                                        Encrypted:false
                                                                        SSDEEP:24:ff6cCEDoN5LlRM0mYnnzWKCOZGOIfFdUhQValNpgKMpRDyTqCIWbD:ff6aob6YnzUOzQVYgfTDyTq+D
                                                                        MD5:68D9CE1FB803997656A318CB361E7A4B
                                                                        SHA1:9D52E6CB5AE3D250A5477855818FCDFB843164FA
                                                                        SHA-256:46540995303EDA1B6CD801A2D6975735446A878F937D93A4EF9DFF0CD0041F6E
                                                                        SHA-512:E9CF1631B824B47EDB175F144115D2BE2667301B6BD5153387258F5AF934DDCAE913A7FB8087824B27038946A5B8F2E53B9C5B94EE2C5EE455F37B7F9BD7B09F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.<C.....v...R...1qV..h.tMZ.....O........w...Qf....QLL/Y-'.....J...:...wd|..K..O.....a........'.[..R..^..GX.@..V.Q..f.UR.*.V....j..)...P.|..kafD>..Z........R.A5k.......X..03..H<.N..".+.~bE..e`.FE~..w&...0....p..V.|.e....&E#.,P.u.%...i..<.3.E.....N......<.a..&mtpZ.8':..t...=cU.........S&...,(....L.U..A'.B(.[...j....T.....r..Z.u.....C....t..M....9N.....g../....|o...).'.o..........|..&............;.{J/..C..F.r....tO\.%l.O...~..x%)M........"w........w.K...ko..$.c~.6_.........[B.....C..r.......N..T...6J.@.+....u/.7.YU..}.k6T..Wr..L.5m.u...nb............2T#..9..|g...H..#N..j.Yj..!.w~.....^.....q8.....#8Jy.Oq..=..R........8)..2.Sel'.L..Y...RW..*...eG.;\.\..?A._.....!....:..Mi.6.j..q..^.B.l.X.j.Q.r...&N~O.[!|.......Q....%-.2RNk6L....V~;.4Qw.o]j.....9...=.v.!...^G.>.6".{>..o.I.W;.v./.C....+...Q..2..&./.s...}o3S<.y^[.d....Ex....c.8...u.0.....QNMm..3.......}.\....Y...5()..S.....y3....#O..Z..!?-.~.....S........E......p...%9.X.ij..

                                                                        C:\Users\user\Desktop\NEBFQQYWPS.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.854485256448089
                                                                        Encrypted:false
                                                                        SSDEEP:24:ord4O3KNielaC+g4VMLLP/8vhYQ+TiaIhsmfCLcZ9PVTUMbNo96YnWbD:Yfozx+pMPFQ++aksWv7dTzbpYED
                                                                        MD5:43CF9E5F3491079087E516FAFEC6E3E9
                                                                        SHA1:D2078CF184CE16190EBDA50A64BCEC2CD68D1321
                                                                        SHA-256:EA872F188C149FF568241E82B43DF0F77DA7A5A67D610235279B56319F589BB8
                                                                        SHA-512:91667FF70A34FBBE7C5DF02C7409AE357BDE3E81F224B136363418F64FA48E42E80112B2DA669D9BBFA64AFE02B689F97293EC01E122FE5A94B91B4DC7908170
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ..K.."{2:.......eo.R...L...j...ZXk..w....Y.L..`....%H.oi.Yg...9...|D.lQ.ln.g.a..+...g...b...5.D...9C.....)..lFR/5.[#.G..Q.....k1f.M.s......[:.yD.6.W..g.....Q2V.ce..M....k.o..(.H>.&...e...J...F.4p.8....._.Z>....T.....n....'.|ff-d>..U.3.*..ZI{..c.N...j.cV....(&..e........M./.i9.*56..:f..9z5....!.F...nA...i.....K........w7..$s.P.....}.L.....$XU../..(.5..6E..Q...w..P..../w.T....2E...g.+..%...`... )u-P*...e..v.NB/..mx..A..A.@m..v.x..PV.b.....n],.....v...&......QF>.c........Z....`....8.H. .9c.T.p..{kK.@..h..;x.....~|c.....`..x.....k..v.5..y/.Y5.{....Rz.j.~..`0Bxu..3.............d.E.90.1..3.N..e&..?.+.q......x.,.{...:z.Z.$@p...0..m..P>.k,c._.4u7...l.MH.F\.VTx..t..*.T~.....r.?...........}.,......s15...K.z..*._8..Q.bq+t..\....z(..L.u...z7-..4.p*....0..f....r.N..@..#2..........G@!......^2.d..`..+.U....v.(...$....[.5.g...)..=.....:....;^.BB...{F...p.G.+0Y............H9....s.0..E%)Ml.........$....... ....].l..<.\F.......@...T....g.@p#Y.'..Z*n..X.Si.."..

                                                                        C:\Users\user\Desktop\NEBFQQYWPS.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.854485256448089
                                                                        Encrypted:false
                                                                        SSDEEP:24:ord4O3KNielaC+g4VMLLP/8vhYQ+TiaIhsmfCLcZ9PVTUMbNo96YnWbD:Yfozx+pMPFQ++aksWv7dTzbpYED
                                                                        MD5:43CF9E5F3491079087E516FAFEC6E3E9
                                                                        SHA1:D2078CF184CE16190EBDA50A64BCEC2CD68D1321
                                                                        SHA-256:EA872F188C149FF568241E82B43DF0F77DA7A5A67D610235279B56319F589BB8
                                                                        SHA-512:91667FF70A34FBBE7C5DF02C7409AE357BDE3E81F224B136363418F64FA48E42E80112B2DA669D9BBFA64AFE02B689F97293EC01E122FE5A94B91B4DC7908170
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ..K.."{2:.......eo.R...L...j...ZXk..w....Y.L..`....%H.oi.Yg...9...|D.lQ.ln.g.a..+...g...b...5.D...9C.....)..lFR/5.[#.G..Q.....k1f.M.s......[:.yD.6.W..g.....Q2V.ce..M....k.o..(.H>.&...e...J...F.4p.8....._.Z>....T.....n....'.|ff-d>..U.3.*..ZI{..c.N...j.cV....(&..e........M./.i9.*56..:f..9z5....!.F...nA...i.....K........w7..$s.P.....}.L.....$XU../..(.5..6E..Q...w..P..../w.T....2E...g.+..%...`... )u-P*...e..v.NB/..mx..A..A.@m..v.x..PV.b.....n],.....v...&......QF>.c........Z....`....8.H. .9c.T.p..{kK.@..h..;x.....~|c.....`..x.....k..v.5..y/.Y5.{....Rz.j.~..`0Bxu..3.............d.E.90.1..3.N..e&..?.+.q......x.,.{...:z.Z.$@p...0..m..P>.k,c._.4u7...l.MH.F\.VTx..t..*.T~.....r.?...........}.,......s15...K.z..*._8..Q.bq+t..\....z(..L.u...z7-..4.p*....0..f....r.N..@..#2..........G@!......^2.d..`..+.U....v.(...$....[.5.g...)..=.....:....;^.BB...{F...p.G.+0Y............H9....s.0..E%)Ml.........$....... ....].l..<.\F.......@...T....g.@p#Y.'..Z*n..X.Si.."..

                                                                        C:\Users\user\Desktop\NEBFQQYWPS.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.864449653724184
                                                                        Encrypted:false
                                                                        SSDEEP:24:z6q14cJfY3XJV83lX3EI2nrL7UvoMLtlgfquiuGVA7+Fqvohz9O3HnIKNk+1cxWX:xfJSJ4UtLoQet2qaGVY+qvoB6IOXFD
                                                                        MD5:216B4A1FC5AF28A29AABABD701D19B06
                                                                        SHA1:69D1153991577C35CC60DDAF211A6C40929EC480
                                                                        SHA-256:D8E9F94002A9C3CC7B277A2A6C1FAD299B97C439DAEDA617487E5B16EA81F6A4
                                                                        SHA-512:A5ADC2BB83B3E842AC5EC2D39CF6EEFF58C8DA31C38212376C1867F1016275504CDDAD6DEA4BC1C00B3501C7DF82D59ED50219ABD44EBE9C348DBB91EF4FB366
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ......d.......ik....u.{jx..J...f5......>.M.S...=...........JT..5{.Vf../..*F\.t..fF...v.gWg.^n..F....T.8.........?.P..7.?...J+....W.7...d....C..oDu.....&B.v<L'.<.fk:..nA..E.....Ix0&.%.....M...}. .1.....2.J%0.?..4.Ba.-V...K@>...T.....Hk.-.a.d.S.H......{..m..J...a.y...Gh<T..Yv....e..?...........RMS.8...U.t.uGc....t.8..9.B...<...B:-.......'..r.{...L.c.oE.)...B.r.GE."....=.*-a..4..N..np%.l.N.H....=..2I....Z..{.....O,....w"e..h..7My.t..T.v.........w......n6G.........0....?"........X.5..O.+~3..0....WK.+.PQSG...sz. s..Fx.k.\......*.S..)..Z;...T..].~~b.Ai.vS.~.[n:2=..k. .'./(.B...)...X.....RM9}.X#.....`...~..@..4..nt..3.x...ilS.B].}.........Id..S....`..Y.....: .....N.O..%..........,........W...:g.s.`.U?u:J"....P.....'9Gkr0&...Y.......P.f..5.....v.i4u....^/I ....l..%A..,..._......~........i... .I....E$F..p.]....F..^...7....@.....,...B.h.$x5.f.._K..S<..>....j..P..,..q..F..........+;.;i..&"ZNC...."..]....RU.c...3h7..HlVv..Z...F..*.....-.|.. ..a.

                                                                        C:\Users\user\Desktop\NEBFQQYWPS.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.864449653724184
                                                                        Encrypted:false
                                                                        SSDEEP:24:z6q14cJfY3XJV83lX3EI2nrL7UvoMLtlgfquiuGVA7+Fqvohz9O3HnIKNk+1cxWX:xfJSJ4UtLoQet2qaGVY+qvoB6IOXFD
                                                                        MD5:216B4A1FC5AF28A29AABABD701D19B06
                                                                        SHA1:69D1153991577C35CC60DDAF211A6C40929EC480
                                                                        SHA-256:D8E9F94002A9C3CC7B277A2A6C1FAD299B97C439DAEDA617487E5B16EA81F6A4
                                                                        SHA-512:A5ADC2BB83B3E842AC5EC2D39CF6EEFF58C8DA31C38212376C1867F1016275504CDDAD6DEA4BC1C00B3501C7DF82D59ED50219ABD44EBE9C348DBB91EF4FB366
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ......d.......ik....u.{jx..J...f5......>.M.S...=...........JT..5{.Vf../..*F\.t..fF...v.gWg.^n..F....T.8.........?.P..7.?...J+....W.7...d....C..oDu.....&B.v<L'.<.fk:..nA..E.....Ix0&.%.....M...}. .1.....2.J%0.?..4.Ba.-V...K@>...T.....Hk.-.a.d.S.H......{..m..J...a.y...Gh<T..Yv....e..?...........RMS.8...U.t.uGc....t.8..9.B...<...B:-.......'..r.{...L.c.oE.)...B.r.GE."....=.*-a..4..N..np%.l.N.H....=..2I....Z..{.....O,....w"e..h..7My.t..T.v.........w......n6G.........0....?"........X.5..O.+~3..0....WK.+.PQSG...sz. s..Fx.k.\......*.S..)..Z;...T..].~~b.Ai.vS.~.[n:2=..k. .'./(.B...)...X.....RM9}.X#.....`...~..@..4..nt..3.x...ilS.B].}.........Id..S....`..Y.....: .....N.O..%..........,........W...:g.s.`.U?u:J"....P.....'9Gkr0&...Y.......P.f..5.....v.i4u....^/I ....l..%A..,..._......~........i... .I....E$F..p.]....F..^...7....@.....,...B.h.$x5.f.._K..S<..>....j..P..,..q..F..........+;.;i..&"ZNC...."..]....RU.c...3h7..HlVv..Z...F..*.....-.|.. ..a.

                                                                        C:\Users\user\Desktop\PIVFAGEAAV.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.853469992301355
                                                                        Encrypted:false
                                                                        SSDEEP:24:H3qkiqtA5ona9LDPEPxUSv+6I5vlDYO6YNY8SnUiLvuyhRGaIvV9B1eWbD:ae2e0oPxXyv9Z3iL2yhRED7D
                                                                        MD5:B7EC3950A27DFAD401B5830BA7F1DD16
                                                                        SHA1:F2102A2DF7E56181C333A0F959041BFF59E8FAAD
                                                                        SHA-256:C13149AD2C12D3835DBEC0FF6A91AA72CC539FAE95817998601812979CE5C45E
                                                                        SHA-512:50C0283FA985079545727E63245EF8A1F9AB08E0F02E23CC956D7483D6C66A3AE389E32B01F3B828CC5F5597B965B407B2B2A8DD6304703049302F84B56860F5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAj.......&A.I..tk....l..k..~.F\.....+vA.|.v...G...y.......6B....<........9..5I..\.=.g..j.......\.\.cLd.....6......-.c.Bq%I..I.\C.....Id.(._..+..Cq.p...QSm.4.....\.\s.e|...q.q..%.......-!...2.Z;.>.d..H....$....d.....#G..u....{..A.ml.J.....~6....L-.O.....E...S]..d.W%......`.W?.r......9 ..&...Qh....M.....4>u...F.M..[..W..Y.......^RN..NJ...I....b.GA....*.B...2..N..r.o..0.....s...u.0.^x.X(...k;.:.%/[......@. .hfm."..Tj.....G..g}......j.&&.b...DJ.]....2...M.....AN......6...*.K...#.n...)B....rdy,./|.qD.u......^......u..o.D....n....>Sk..>...+....I*Jm.G..T...`$."..6."|..F....-..<....0....*...y.R1.@]..,c...@...R.p.$...)Q..2n.i...m.Y._..^Z.%]....g...%..T..sp........n..ns..Z$2.S.w."y.H.Wb.~.N......ZzGY?...O......u.......B.Q.\-...)t?=...eR..tC..x1.....A..3.<.X$..v"b.$..G....2...M..7x........I.i.(....jO}.L... ..q>......8.x..!....1.G......g.)=0..L......\....U_..A.>..^........AG...i.j..M..N.al.{..GS.`..y].M...1.H%j..$\.V.}.....1%..U.Xw/..r.u.

                                                                        C:\Users\user\Desktop\PIVFAGEAAV.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.853469992301355
                                                                        Encrypted:false
                                                                        SSDEEP:24:H3qkiqtA5ona9LDPEPxUSv+6I5vlDYO6YNY8SnUiLvuyhRGaIvV9B1eWbD:ae2e0oPxXyv9Z3iL2yhRED7D
                                                                        MD5:B7EC3950A27DFAD401B5830BA7F1DD16
                                                                        SHA1:F2102A2DF7E56181C333A0F959041BFF59E8FAAD
                                                                        SHA-256:C13149AD2C12D3835DBEC0FF6A91AA72CC539FAE95817998601812979CE5C45E
                                                                        SHA-512:50C0283FA985079545727E63245EF8A1F9AB08E0F02E23CC956D7483D6C66A3AE389E32B01F3B828CC5F5597B965B407B2B2A8DD6304703049302F84B56860F5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAj.......&A.I..tk....l..k..~.F\.....+vA.|.v...G...y.......6B....<........9..5I..\.=.g..j.......\.\.cLd.....6......-.c.Bq%I..I.\C.....Id.(._..+..Cq.p...QSm.4.....\.\s.e|...q.q..%.......-!...2.Z;.>.d..H....$....d.....#G..u....{..A.ml.J.....~6....L-.O.....E...S]..d.W%......`.W?.r......9 ..&...Qh....M.....4>u...F.M..[..W..Y.......^RN..NJ...I....b.GA....*.B...2..N..r.o..0.....s...u.0.^x.X(...k;.:.%/[......@. .hfm."..Tj.....G..g}......j.&&.b...DJ.]....2...M.....AN......6...*.K...#.n...)B....rdy,./|.qD.u......^......u..o.D....n....>Sk..>...+....I*Jm.G..T...`$."..6."|..F....-..<....0....*...y.R1.@]..,c...@...R.p.$...)Q..2n.i...m.Y._..^Z.%]....g...%..T..sp........n..ns..Z$2.S.w."y.H.Wb.~.N......ZzGY?...O......u.......B.Q.\-...)t?=...eR..tC..x1.....A..3.<.X$..v"b.$..G....2...M..7x........I.i.(....jO}.L... ..q>......8.x..!....1.G......g.)=0..L......\....U_..A.>..^........AG...i.j..M..N.al.{..GS.`..y].M...1.H%j..$\.V.}.....1%..U.Xw/..r.u.

                                                                        C:\Users\user\Desktop\PIVFAGEAAV.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.839573925100181
                                                                        Encrypted:false
                                                                        SSDEEP:24:SZx5aU7K745dktTdgHTwZAZhIZAQJhS5ljq4WJqfzTE2/Ezwd3YWbD:Ixsar3iaznuZAoS5l2NUzw2szU3dD
                                                                        MD5:33560E374EBFB6E4E23E0AC4F52880A7
                                                                        SHA1:A4B637EC64EC5BC89A96317891794496E7B93B5C
                                                                        SHA-256:A5961EA9B3035C46447496C023CAB1BFEF34C79B71A9C09242F2A1681398B741
                                                                        SHA-512:B01E17E7DCD4193DBF54B19713B1040A1B2608AFE796D3956D3AF24319845891E0061736E0C13435F1ACF2BA36DE3483CED3EBDE98C4416D2A1FEDF87D19A397
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAd.U.2..3n......e )'.y-.`...h....C..}./..b..e.s......{...P..wOtg?:.....o..M.\S.....F*.\2)oR..<....3..&....h.AAIB.......J....O.*..0.kP5_..Aa.9...V.#...#.>P-;c.5..F..r.|....YM>{.J.yV.F.a...i.0.~.......e.G....O!....;.arQ~...X.a}N.........yj..cA..n.M...b.?..Y#...z...%.;.c......_w.0a....i..I.G+.r..Li...pt9>..-.....r..U&)I..c.!y....?..'..%bhv........S.t..j..6k4.+.*SD.q.......S...g.&$N.Oz..S.}...@...l.#.c..E...\...=?>./..>S.fkj...R..<Av.RM+..4=;..N1v\+..G...J..!./.....D...z....D"e.il.......\H ..c1......6.t...E....v.\....P...p.....@.{..H..9*T...A..c....n ....!i...&....Aa,W..?Z.j...`.V>`.d/8Q..[..........(.f....).k..fW...0.E..aP...y~Z......u.."p^.x....g....lz..@.K..U.lG;U..v3.......^.@.IH.*..~...D^.4~U...<p...../.l[..:)..%d .|n..'...iE.....;..6....`.G.J...?s..5......(... .../2.Sy......-...X.Vy..gJ..._w.&3...sG.c+.....6R....O..(.\.hZ...n].o..Fc.....p.w5.6..|.I.P...Z.+...xku.`oQ...yZ..)...0u.v#.q..6c......2..lQ..)%.i..4..]....kDp.i.b9....6.T)..lM

                                                                        C:\Users\user\Desktop\PIVFAGEAAV.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.839573925100181
                                                                        Encrypted:false
                                                                        SSDEEP:24:SZx5aU7K745dktTdgHTwZAZhIZAQJhS5ljq4WJqfzTE2/Ezwd3YWbD:Ixsar3iaznuZAoS5l2NUzw2szU3dD
                                                                        MD5:33560E374EBFB6E4E23E0AC4F52880A7
                                                                        SHA1:A4B637EC64EC5BC89A96317891794496E7B93B5C
                                                                        SHA-256:A5961EA9B3035C46447496C023CAB1BFEF34C79B71A9C09242F2A1681398B741
                                                                        SHA-512:B01E17E7DCD4193DBF54B19713B1040A1B2608AFE796D3956D3AF24319845891E0061736E0C13435F1ACF2BA36DE3483CED3EBDE98C4416D2A1FEDF87D19A397
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAd.U.2..3n......e )'.y-.`...h....C..}./..b..e.s......{...P..wOtg?:.....o..M.\S.....F*.\2)oR..<....3..&....h.AAIB.......J....O.*..0.kP5_..Aa.9...V.#...#.>P-;c.5..F..r.|....YM>{.J.yV.F.a...i.0.~.......e.G....O!....;.arQ~...X.a}N.........yj..cA..n.M...b.?..Y#...z...%.;.c......_w.0a....i..I.G+.r..Li...pt9>..-.....r..U&)I..c.!y....?..'..%bhv........S.t..j..6k4.+.*SD.q.......S...g.&$N.Oz..S.}...@...l.#.c..E...\...=?>./..>S.fkj...R..<Av.RM+..4=;..N1v\+..G...J..!./.....D...z....D"e.il.......\H ..c1......6.t...E....v.\....P...p.....@.{..H..9*T...A..c....n ....!i...&....Aa,W..?Z.j...`.V>`.d/8Q..[..........(.f....).k..fW...0.E..aP...y~Z......u.."p^.x....g....lz..@.K..U.lG;U..v3.......^.@.IH.*..~...D^.4~U...<p...../.l[..:)..%d .|n..'...iE.....;..6....`.G.J...?s..5......(... .../2.Sy......-...X.Vy..gJ..._w.&3...sG.c+.....6R....O..(.\.hZ...n].o..Fc.....p.w5.6..|.I.P...Z.+...xku.`oQ...yZ..)...0u.v#.q..6c......2..lQ..)%.i..4..]....kDp.i.b9....6.T)..lM

                                                                        C:\Users\user\Desktop\PWCCAWLGRE.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.839578902837243
                                                                        Encrypted:false
                                                                        SSDEEP:24:E5+QOOzzy4+io1/9svHQ5EngfXdOqP8IvGwvOmrv6iFXLmugfWbD:yBHzzvs11OZnYXdOqkwvOmr5F7D
                                                                        MD5:96906FF034348FCE170747F02D27C2EE
                                                                        SHA1:980BCD47A2DF46029D517008A58D08FF7EB28232
                                                                        SHA-256:EF0291127BB6E9E87354938C6B72A1EB97EC2B38237FE74510E1C954CF7C9EED
                                                                        SHA-512:8C2486F399FB2D903CE5C1491B7186349EBA9D74B177B461C1719240B8F69A531B5D57574BE8FFFDF87586250232D7BC7C4DBCF9D5BAC30019396039AECA1315
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA0.%.~.E.)......|.zx.f..j!.yC._. .I...\>gA..6....u.....%.Y...!.0....| ....D..l..9 c.b...k. .....{z...j..A7@.....Gsb..J..S.v.-....hr#z.T.\.Q...b..."N.R......QK...}..........".G.....^.T.........A..y.. ..z...H...x..v.5.?..Z?D.pIe.....[...bI.R....f.T.2>.....{#......H..S....<Z....<p........A..z.....&0...fdo\w.)].GG..2=E.w4.1..E...Wb.e(..Oa.....t.Y.H....Le..*.w.....6l......_.$.)....KI...}@.FB]V..........B.a.6..K..l.3..)...CG.3Y.....|.O.3D7k)K|P.&3...&.w).sC,.O.F.I......b..%x..o}...!E..c.w........H....LIt@......+.....H.FJ9..6.[..j...V.a..g.....W1.....`.4....q..3....F.S....y.U4O19C...p..$D1...,=....|s<v.J....G.x....e.....G.E].O..|..dg.rg..X.. ..E.y.o....].*;.....z...L..3.ML.d.0kRD..n..C.K..Z.O...-kx..1..K..o.P.f..em..37....q....`K!.{L..:.;..._.I..1Qr#.....egM.G.V..L.lC'....H.r....[.P...G../`p...z..{.i}.?yT.....5...&.#M.-..!.#..$.....?.x.)....>.#,RZ......e..N?.8........QN... F.b(.7./...k:.%Hg#...g.P^6..o.G\.......fyn....{.F.....6....-.

                                                                        C:\Users\user\Desktop\PWCCAWLGRE.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.839578902837243
                                                                        Encrypted:false
                                                                        SSDEEP:24:E5+QOOzzy4+io1/9svHQ5EngfXdOqP8IvGwvOmrv6iFXLmugfWbD:yBHzzvs11OZnYXdOqkwvOmr5F7D
                                                                        MD5:96906FF034348FCE170747F02D27C2EE
                                                                        SHA1:980BCD47A2DF46029D517008A58D08FF7EB28232
                                                                        SHA-256:EF0291127BB6E9E87354938C6B72A1EB97EC2B38237FE74510E1C954CF7C9EED
                                                                        SHA-512:8C2486F399FB2D903CE5C1491B7186349EBA9D74B177B461C1719240B8F69A531B5D57574BE8FFFDF87586250232D7BC7C4DBCF9D5BAC30019396039AECA1315
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA0.%.~.E.)......|.zx.f..j!.yC._. .I...\>gA..6....u.....%.Y...!.0....| ....D..l..9 c.b...k. .....{z...j..A7@.....Gsb..J..S.v.-....hr#z.T.\.Q...b..."N.R......QK...}..........".G.....^.T.........A..y.. ..z...H...x..v.5.?..Z?D.pIe.....[...bI.R....f.T.2>.....{#......H..S....<Z....<p........A..z.....&0...fdo\w.)].GG..2=E.w4.1..E...Wb.e(..Oa.....t.Y.H....Le..*.w.....6l......_.$.)....KI...}@.FB]V..........B.a.6..K..l.3..)...CG.3Y.....|.O.3D7k)K|P.&3...&.w).sC,.O.F.I......b..%x..o}...!E..c.w........H....LIt@......+.....H.FJ9..6.[..j...V.a..g.....W1.....`.4....q..3....F.S....y.U4O19C...p..$D1...,=....|s<v.J....G.x....e.....G.E].O..|..dg.rg..X.. ..E.y.o....].*;.....z...L..3.ML.d.0kRD..n..C.K..Z.O...-kx..1..K..o.P.f..em..37....q....`K!.{L..:.;..._.I..1Qr#.....egM.G.V..L.lC'....H.r....[.P...G../`p...z..{.i}.?yT.....5...&.#M.-..!.#..$.....?.x.)....>.#,RZ......e..N?.8........QN... F.b(.7./...k:.%Hg#...g.P^6..o.G\.......fyn....{.F.....6....-.

                                                                        C:\Users\user\Desktop\QCFWYSKMHA.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.845024440508264
                                                                        Encrypted:false
                                                                        SSDEEP:24:U1ztMAI0L6OmXfpmJ+wnEyhw+F8alSxDJAnaxEnz/2Gnb9aBH/WbD:UwemxmJTzhj8MSJAn9nCI9aBsD
                                                                        MD5:AEFD213867C36399F3005DDD1AABA11A
                                                                        SHA1:1203622759DF67614BA9FF0B143EC6DF9D7F15BF
                                                                        SHA-256:E7EB2D6B2A9F89F1AD4EA8024A6DC130B7DCB97EAEF8EA4EB0DB2FBEAF88E42B
                                                                        SHA-512:567299E68E1F869179D7F0EF453D2EFDEE3F0619BA57D732AEED810DA883B3F1DE6B53331DEBFB9FE3FA4880B9F2BD89BF3CF98259BF35E467F8F0CEDABDBB1B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWYt>.i V..9..}..{%...rD..&..9i.....^6........!l.{.Q*...B....a.`...]T'Q}.[..../.a...ym..8.V....n.Q@c.G......E/G>e.y..P:a....*]9....P.Adj.,"_..R.r.... ..B...i....=.M.z.=/..J2._R:.......5"Hy$uD..G.B...P.a.:/9u@<.c....qy.;..\./w.;2.v._3..R.8.. ........y..).N....)L.wQU...H./Ft...Z.........>..[k....2Z.Pz|..P(. ..HfW..`....l.o.....".U..<H.P..>.r...2il.=j..o2......e}......3K.*NN(~9......4.....g...L..T....?.(..M`..l....S. .lc...l.G.....v.3I.*.;.$.).dk.cf.. ......2.....xA.0.I....a..p.kFhG.........CP-q...*l..K\A2.w`iA.S...s....tf...W.i....F(.-......_..E.s.....E.my.r.ow......`..Zf ...g...[N..E.*)..40I.....V..R...nM....:E.........O40d......$.J?...o...&..~F......D.P..?.(z.bb-@...Z....l8.~$..."|...Nj.lqdnJ.3@.2......ry.+.`...@.,.A.Rb.I....p~..l..... .V..M.....G.c"X.#?.8$N.`..s.8......GY.b......l....D..e|..?.b.H..aY....3.....u\_......j.^K...h..<<.9-....ot...........n.....K".1.....&..c{m"...z.u..?...L........_$...*...d.k.G........&....?.4.x.

                                                                        C:\Users\user\Desktop\QCFWYSKMHA.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.845024440508264
                                                                        Encrypted:false
                                                                        SSDEEP:24:U1ztMAI0L6OmXfpmJ+wnEyhw+F8alSxDJAnaxEnz/2Gnb9aBH/WbD:UwemxmJTzhj8MSJAn9nCI9aBsD
                                                                        MD5:AEFD213867C36399F3005DDD1AABA11A
                                                                        SHA1:1203622759DF67614BA9FF0B143EC6DF9D7F15BF
                                                                        SHA-256:E7EB2D6B2A9F89F1AD4EA8024A6DC130B7DCB97EAEF8EA4EB0DB2FBEAF88E42B
                                                                        SHA-512:567299E68E1F869179D7F0EF453D2EFDEE3F0619BA57D732AEED810DA883B3F1DE6B53331DEBFB9FE3FA4880B9F2BD89BF3CF98259BF35E467F8F0CEDABDBB1B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWYt>.i V..9..}..{%...rD..&..9i.....^6........!l.{.Q*...B....a.`...]T'Q}.[..../.a...ym..8.V....n.Q@c.G......E/G>e.y..P:a....*]9....P.Adj.,"_..R.r.... ..B...i....=.M.z.=/..J2._R:.......5"Hy$uD..G.B...P.a.:/9u@<.c....qy.;..\./w.;2.v._3..R.8.. ........y..).N....)L.wQU...H./Ft...Z.........>..[k....2Z.Pz|..P(. ..HfW..`....l.o.....".U..<H.P..>.r...2il.=j..o2......e}......3K.*NN(~9......4.....g...L..T....?.(..M`..l....S. .lc...l.G.....v.3I.*.;.$.).dk.cf.. ......2.....xA.0.I....a..p.kFhG.........CP-q...*l..K\A2.w`iA.S...s....tf...W.i....F(.-......_..E.s.....E.my.r.ow......`..Zf ...g...[N..E.*)..40I.....V..R...nM....:E.........O40d......$.J?...o...&..~F......D.P..?.(z.bb-@...Z....l8.~$..."|...Nj.lqdnJ.3@.2......ry.+.`...@.,.A.Rb.I....p~..l..... .V..M.....G.c"X.#?.8$N.`..s.8......GY.b......l....D..e|..?.b.H..aY....3.....u\_......j.^K...h..<<.9-....ot...........n.....K".1.....&..c{m"...z.u..?...L........_$...*...d.k.G........&....?.4.x.

                                                                        C:\Users\user\Desktop\QNCYCDFIJJ.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.84938074351079
                                                                        Encrypted:false
                                                                        SSDEEP:24:Htk6Bums5PKFBgx7da7PgbzCt7zr1cz2HkPo+FQj8GtoWgms/lWVPW/5ki9mvnM5:u6B5gbyzhcdPtGj8moW5alWVPWFsMxD
                                                                        MD5:DC4B73BB13C213F2BA883C50D5E98224
                                                                        SHA1:AD773C78CD94D59B095DC925E689BF503AEDF425
                                                                        SHA-256:41C1BE3C43D810D51E40C9ED495A599A4207DC921E7D45954EE7C3B51031F059
                                                                        SHA-512:42A13D60385AFACDA57A51A1A17FA92E6262134E201685F5DB9D3647118F03201EB3F6903C6ED7DFE9D841A2A75DC9BEAB13AD773196D82031784038725FEEC9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC...0..^q.p]$.%l..Npob#...n..T.H-.2.Smu..>.....6.eu././Ay.o.....Z...UM......C....,.-.V.&}r..B?.LPB.Kpog^."..@G.7.E...&O..y.xm..y..Z~..H|.<...J..t..YS.....H...z....4\....r..L...."....H...R>f..;........\...1.?p.W.....s.....E.+T.Y.T..z..?.Z...zY.....G........N.."a..E9....VO#.....k........J....X.{.{..r..,k...D/`.Rx.g...3..y...=.Q..l:....I...>.cV.....J.*.cE...Dt.k.~...t....b.?.Y.\<..&.Y...V.x.3.5..P.1.].....O.7......W..y'..#fH.@Y....s....^M~..P.@2`......{.!u.........N....~...*...P. |-..:./..DM....[.c=..19..6:..l.Y.......B..O......Z-..GBD.%W.C..... 7..1.T.z.....~.G........._......zp....i#.l...m9.....jv..{,at...\.......~....A,..Q...#....P.w....m....E(m..F$.a1.......K..[`..6...Tk...rU.&.J...1..n..OV.........c..t.....,C.<.G...X.m93i.!q].."~wC....Q.1..2......&...@.....U~..q.8.eBX.8...T....g..0.r|.a(...7\'F.....).k......#..|..9...oG7...6S......m....R..|..N.P..?....@...d_.wi.h....,.8.Z.....h....W..U16..%}...'S."......o.\....+.7.W..m.azo

                                                                        C:\Users\user\Desktop\QNCYCDFIJJ.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.84938074351079
                                                                        Encrypted:false
                                                                        SSDEEP:24:Htk6Bums5PKFBgx7da7PgbzCt7zr1cz2HkPo+FQj8GtoWgms/lWVPW/5ki9mvnM5:u6B5gbyzhcdPtGj8moW5alWVPWFsMxD
                                                                        MD5:DC4B73BB13C213F2BA883C50D5E98224
                                                                        SHA1:AD773C78CD94D59B095DC925E689BF503AEDF425
                                                                        SHA-256:41C1BE3C43D810D51E40C9ED495A599A4207DC921E7D45954EE7C3B51031F059
                                                                        SHA-512:42A13D60385AFACDA57A51A1A17FA92E6262134E201685F5DB9D3647118F03201EB3F6903C6ED7DFE9D841A2A75DC9BEAB13AD773196D82031784038725FEEC9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC...0..^q.p]$.%l..Npob#...n..T.H-.2.Smu..>.....6.eu././Ay.o.....Z...UM......C....,.-.V.&}r..B?.LPB.Kpog^."..@G.7.E...&O..y.xm..y..Z~..H|.<...J..t..YS.....H...z....4\....r..L...."....H...R>f..;........\...1.?p.W.....s.....E.+T.Y.T..z..?.Z...zY.....G........N.."a..E9....VO#.....k........J....X.{.{..r..,k...D/`.Rx.g...3..y...=.Q..l:....I...>.cV.....J.*.cE...Dt.k.~...t....b.?.Y.\<..&.Y...V.x.3.5..P.1.].....O.7......W..y'..#fH.@Y....s....^M~..P.@2`......{.!u.........N....~...*...P. |-..:./..DM....[.c=..19..6:..l.Y.......B..O......Z-..GBD.%W.C..... 7..1.T.z.....~.G........._......zp....i#.l...m9.....jv..{,at...\.......~....A,..Q...#....P.w....m....E(m..F$.a1.......K..[`..6...Tk...rU.&.J...1..n..OV.........c..t.....,C.<.G...X.m93i.!q].."~wC....Q.1..2......&...@.....U~..q.8.eBX.8...T....g..0.r|.a(...7\'F.....).k......#..|..9...oG7...6S......m....R..|..N.P..?....@...d_.wi.h....,.8.Z.....h....W..U16..%}...'S."......o.\....+.7.W..m.azo

                                                                        C:\Users\user\Desktop\SFPUSAFIOL.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859374215086906
                                                                        Encrypted:false
                                                                        SSDEEP:24:1nC0Fy0CZvSLuUwi6ujAHvaLZ7Du+wc8xxFF91gUtA4I2i0nGpzQKM+8sI30uuL1:1NfivaVfuZc8x77ttAD2WBQrvRkuuLp7
                                                                        MD5:F2EF4E8916AF4DC5788ED3DBC64ADDBC
                                                                        SHA1:CF8B4FB6AC6550DCB4EB2F594F49B967364A7412
                                                                        SHA-256:531C07FE52DC66F6A8A117625D803EE31D42FE229331C870E398FEBA39348565
                                                                        SHA-512:90F9D2ACEC246BC65836CA7A6991606E38C113C9BD6380116FFD4055D07491B49CE92839CC9ED79E966606347064E50F4555ABA48591220E753BDA8B433F788E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS...*.....8E8A/.*..w.6'.|.,...d..%..>...[.%".....NB.z.lI.n...\.f...l..2.wB..[e.^.o.B.z7....t.@...{\..FL$...p.-..b.).u.MEM1O....}...5....7.......8..".#..}..Q.p.h....h..V..s..7a.0..|.o..|Y..P....o...o.?"..a....../.....g"&C..V.+.b6q........*%.K..t....=*8....M.2z.....@u.sZ.;.......j..QGo..]..*w...hf@..X.@...'...f.t...w..e?.......i....].B..VK..f:V.QZ>...J....A......,{.......d`.h:|y.3......Q..=MJ!...5tTX.A*..Mr..G...<..vh0QU...U...:...k..U.>t.Y...*.}.%d...>.?..JT.n$.[.Wg..........r!.}}.(.<.>c.S...=..I....Cb.U....G.44\......}D>..&.....Y8...#....6....~...j..bs.[..(.y.....y}.Ai.K.'..Lss3Z.......`..x./%e.'L...=.@p.0.R)F..n'm..,..g.5R.....I8d.`..E.........Wk......k.b....)...\.f./.X5.^.w,...>....fw....D..3..........1d...L".n.......7...<.r0..U1K`N....G.g^..,......F..7."qG..X.LW..9..+]M....X}..Q..!.n.D.q8.....Q]...@e....4....Hl.8|....M..yv$.".}..YgR....I.... ...g{.A.*Nn..u...b....O`.o.....'......z./...o8LO)k/{.Mj^*$?h.....M..^N|x49$G..x.Q....mJ.......U.*.

                                                                        C:\Users\user\Desktop\SFPUSAFIOL.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859374215086906
                                                                        Encrypted:false
                                                                        SSDEEP:24:1nC0Fy0CZvSLuUwi6ujAHvaLZ7Du+wc8xxFF91gUtA4I2i0nGpzQKM+8sI30uuL1:1NfivaVfuZc8x77ttAD2WBQrvRkuuLp7
                                                                        MD5:F2EF4E8916AF4DC5788ED3DBC64ADDBC
                                                                        SHA1:CF8B4FB6AC6550DCB4EB2F594F49B967364A7412
                                                                        SHA-256:531C07FE52DC66F6A8A117625D803EE31D42FE229331C870E398FEBA39348565
                                                                        SHA-512:90F9D2ACEC246BC65836CA7A6991606E38C113C9BD6380116FFD4055D07491B49CE92839CC9ED79E966606347064E50F4555ABA48591220E753BDA8B433F788E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS...*.....8E8A/.*..w.6'.|.,...d..%..>...[.%".....NB.z.lI.n...\.f...l..2.wB..[e.^.o.B.z7....t.@...{\..FL$...p.-..b.).u.MEM1O....}...5....7.......8..".#..}..Q.p.h....h..V..s..7a.0..|.o..|Y..P....o...o.?"..a....../.....g"&C..V.+.b6q........*%.K..t....=*8....M.2z.....@u.sZ.;.......j..QGo..]..*w...hf@..X.@...'...f.t...w..e?.......i....].B..VK..f:V.QZ>...J....A......,{.......d`.h:|y.3......Q..=MJ!...5tTX.A*..Mr..G...<..vh0QU...U...:...k..U.>t.Y...*.}.%d...>.?..JT.n$.[.Wg..........r!.}}.(.<.>c.S...=..I....Cb.U....G.44\......}D>..&.....Y8...#....6....~...j..bs.[..(.y.....y}.Ai.K.'..Lss3Z.......`..x./%e.'L...=.@p.0.R)F..n'm..,..g.5R.....I8d.`..E.........Wk......k.b....)...\.f./.X5.^.w,...>....fw....D..3..........1d...L".n.......7...<.r0..U1K`N....G.g^..,......F..7."qG..X.LW..9..+]M....X}..Q..!.n.D.q8.....Q]...@e....4....Hl.8|....M..yv$.".}..YgR....I.... ...g{.A.*Nn..u...b....O`.o.....'......z./...o8LO)k/{.Mj^*$?h.....M..^N|x49$G..x.Q....mJ.......U.*.

                                                                        C:\Users\user\Desktop\SFPUSAFIOL.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865161120288568
                                                                        Encrypted:false
                                                                        SSDEEP:24:REDl6rp8Vo17Ef96WoGF8d61r9hPmpnpSo5x1g4u8WbD:Wl698exgjEnfw1BD
                                                                        MD5:01B37DEBBB1B273E21A18D76495BBC23
                                                                        SHA1:D8999433A48D77C7552C34AE36F4B622C6C7EE58
                                                                        SHA-256:263B47EA9DCFA058F6236B8DE36B68C104F0011BB67EC198CE97CC9CD9D7777C
                                                                        SHA-512:A754394D6265B29AB935A21FCE65BA31D9AB8BAFCD4B5CCEA207B50C7BCE5186DF96C9F8CCBE1CF7494CD25B6321D682F113F9362C3080FA7382E86C2B3BE03D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS..S...m...|m1...`EP.....v..Xj.f.%.U.......@......l.P..c...<.o...g.p[...j.?`....y.w.{...'........vu.&.#......-./........yl`6..+..]....=s...0?.R.v?y....C.......$.._...N...m`...=.`...a.H9...Y.s1..r.F.4r@Y^..;..X_.G.)..O}..H..n..rpp.`+Q..M.jy.........e.Q.....O.R8......u.i.M.|5J.dgc.r..L.v....^.`....C.w...D..:.Hp..|.....9a.+...1.]R,.......z4....T*...q)..........{v..Y...I..Y..xgf....Y..D.4?....L.....b..,!....w....#'M.7Z[..Pf.k ..R...\K.:.gE..i.u......+.L..+..J..!......)X600.]\...$..@v.q..z.Q.t.3uK...a....a..N.r...O...4C....X.`.../....=...I.A.V.y....o...3kGe.5.......r<J..R..v..j*._.....y...::.....9@..=..*.V./.T1=..{}.....%..i..Q.~.Q.;......9...>.4./...B...&.I...|.c9.x_mX..k..@......Z.*vt.....?...].z...2...0.G.if...@....n.m.,.B.%P,.j!].R....5g..........>RG..r!..Rq......F.}.. =E.."E.BL..#../..+.V.}]Q.....%_qi..n....A5..:.Y.........y._Cy6..S:#GcN..B...n...Ct)... ..&.....U....qk.....c.0..$...b..)@".1.d?..cw......Av.o.YB...K.....j.=uG

                                                                        C:\Users\user\Desktop\SFPUSAFIOL.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865161120288568
                                                                        Encrypted:false
                                                                        SSDEEP:24:REDl6rp8Vo17Ef96WoGF8d61r9hPmpnpSo5x1g4u8WbD:Wl698exgjEnfw1BD
                                                                        MD5:01B37DEBBB1B273E21A18D76495BBC23
                                                                        SHA1:D8999433A48D77C7552C34AE36F4B622C6C7EE58
                                                                        SHA-256:263B47EA9DCFA058F6236B8DE36B68C104F0011BB67EC198CE97CC9CD9D7777C
                                                                        SHA-512:A754394D6265B29AB935A21FCE65BA31D9AB8BAFCD4B5CCEA207B50C7BCE5186DF96C9F8CCBE1CF7494CD25B6321D682F113F9362C3080FA7382E86C2B3BE03D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS..S...m...|m1...`EP.....v..Xj.f.%.U.......@......l.P..c...<.o...g.p[...j.?`....y.w.{...'........vu.&.#......-./........yl`6..+..]....=s...0?.R.v?y....C.......$.._...N...m`...=.`...a.H9...Y.s1..r.F.4r@Y^..;..X_.G.)..O}..H..n..rpp.`+Q..M.jy.........e.Q.....O.R8......u.i.M.|5J.dgc.r..L.v....^.`....C.w...D..:.Hp..|.....9a.+...1.]R,.......z4....T*...q)..........{v..Y...I..Y..xgf....Y..D.4?....L.....b..,!....w....#'M.7Z[..Pf.k ..R...\K.:.gE..i.u......+.L..+..J..!......)X600.]\...$..@v.q..z.Q.t.3uK...a....a..N.r...O...4C....X.`.../....=...I.A.V.y....o...3kGe.5.......r<J..R..v..j*._.....y...::.....9@..=..*.V./.T1=..{}.....%..i..Q.~.Q.;......9...>.4./...B...&.I...|.c9.x_mX..k..@......Z.*vt.....?...].z...2...0.G.if...@....n.m.,.B.%P,.j!].R....5g..........>RG..r!..Rq......F.}.. =E.."E.BL..#../..+.V.}]Q.....%_qi..n....A5..:.Y.........y._Cy6..S:#GcN..B...n...Ct)... ..&.....U....qk.....c.0..$...b..)@".1.d?..cw......Av.o.YB...K.....j.=uG

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\NEBFQQYWPS.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867859255271756
                                                                        Encrypted:false
                                                                        SSDEEP:24:S150eDRHOwnag0MBnRtZzgWrjdzlU+VAwDxQOSxNA4DxhVvvZlxlWbD:adhagxxLZzgQdhUS2DlvDxiD
                                                                        MD5:D53EC77247731FADC7B3A87F1908944D
                                                                        SHA1:7A3FFAB2F11CC61668911B1C69D219A56494538E
                                                                        SHA-256:4EC9E04A8E3ECFE15D03DE6482566A3039C5EC8D9F4AF673AE0A361A78D035FF
                                                                        SHA-512:EA9AC1290DA624E21D05AEEFDBB519B2E945A32471EAA27538F14290738AE381A36519B9223CB5013FE69BED000598BE7783D21DD963133D7D8707EDB47B136C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ_1v5....b.}...m..It.3.,..Y_.A"..S.....IX>.JEg;...gp.4.m...yWq...PC.-...T..W..7..V..A..9.......:an..%.............U. p.f...d.N^.U...e.`.7(.....rTU:tdA..c.SJ'..z...Wu.PG5..A..A. R}..>&...{C....E..xo%..)..;..&...T&.Y..N1.......5...$j.4.A..J.........H.....B..?e-.`..N.`..R9TX}/.O[...,g5_.J|d.q.,P.5.....$...@..r.p......l.C..Q..0z.X....2.......;..a5.X...,H...g.....a..d<^.@.{hG(._|.Z.*..Z.y4.SC..".i.wl.k..@.yh..O.ov.....-.....V-.d...k\Z.f..^.r......# .7@...4....@1..4.:H...-.!.....D..M.[2^!.....kn...z,..,.]8d.W..CV.-u.7.A..&..]/.A....mP#3.!..0.........iX.a..Y..B.E..*...X....r......Owd..9~.+*+..C...$X..R.....X.e.{..xZ..)5...6...!.]..x.<5Ap.D. .v$I~...%<.b.[Q..{.^.1G..H.....rKN.Y...0..^..HPx..N..g=!.>.bs..._./.....?.[N^..R..sXWd,.@*....d.A.\..i..|w..?d.(....0..O.........X....<.#.j...>.25..2.......M*...A..6......,X.:x.....i..*]^.6....Mj..Y4#.RQ......X...c..F".B..n.../..z..[:+n..).D.....F|s...s...J.S9..^h...,...#.va..^.W..Y...e.w..'.."...H

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\NEBFQQYWPS.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867859255271756
                                                                        Encrypted:false
                                                                        SSDEEP:24:S150eDRHOwnag0MBnRtZzgWrjdzlU+VAwDxQOSxNA4DxhVvvZlxlWbD:adhagxxLZzgQdhUS2DlvDxiD
                                                                        MD5:D53EC77247731FADC7B3A87F1908944D
                                                                        SHA1:7A3FFAB2F11CC61668911B1C69D219A56494538E
                                                                        SHA-256:4EC9E04A8E3ECFE15D03DE6482566A3039C5EC8D9F4AF673AE0A361A78D035FF
                                                                        SHA-512:EA9AC1290DA624E21D05AEEFDBB519B2E945A32471EAA27538F14290738AE381A36519B9223CB5013FE69BED000598BE7783D21DD963133D7D8707EDB47B136C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ_1v5....b.}...m..It.3.,..Y_.A"..S.....IX>.JEg;...gp.4.m...yWq...PC.-...T..W..7..V..A..9.......:an..%.............U. p.f...d.N^.U...e.`.7(.....rTU:tdA..c.SJ'..z...Wu.PG5..A..A. R}..>&...{C....E..xo%..)..;..&...T&.Y..N1.......5...$j.4.A..J.........H.....B..?e-.`..N.`..R9TX}/.O[...,g5_.J|d.q.,P.5.....$...@..r.p......l.C..Q..0z.X....2.......;..a5.X...,H...g.....a..d<^.@.{hG(._|.Z.*..Z.y4.SC..".i.wl.k..@.yh..O.ov.....-.....V-.d...k\Z.f..^.r......# .7@...4....@1..4.:H...-.!.....D..M.[2^!.....kn...z,..,.]8d.W..CV.-u.7.A..&..]/.A....mP#3.!..0.........iX.a..Y..B.E..*...X....r......Owd..9~.+*+..C...$X..R.....X.e.{..xZ..)5...6...!.]..x.<5Ap.D. .v$I~...%<.b.[Q..{.^.1G..H.....rKN.Y...0..^..HPx..N..g=!.>.bs..._./.....?.[N^..R..sXWd,.@*....d.A.\..i..|w..?d.(....0..O.........X....<.#.j...>.25..2.......M*...A..6......,X.:x.....i..*]^.6....Mj..Y4#.RQ......X...c..F".B..n.../..z..[:+n..).D.....F|s...s...J.S9..^h...,...#.va..^.W..Y...e.w..'.."...H

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\PIVFAGEAAV.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.826543814084529
                                                                        Encrypted:false
                                                                        SSDEEP:24:f4c0qHyEONiPW5BwV8rdbzOmmqIY5jaByMUWnJu5O0+anKPSSR6GWbD:N0EyEAiPQ5bzRm457WnJu5P+aKPSljD
                                                                        MD5:2DEB56EB782F7EFD6B8A885D842C4D1E
                                                                        SHA1:35A61C0290A1FC2D289785FEBD599FD6BB18DBA8
                                                                        SHA-256:EA0B7054FE8658B9CBCBF5581DEFB8BA43BF1520C4AA73854AD21F0A47A9529F
                                                                        SHA-512:F27D2C5A24F51738F05C8D6B42435241002806C2A6DA56E38C1E0763152663A73C213487926D3A28E44365FE000CAEC8460EE8030B941EBDF80D84734251991F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.b.R......D..E..07.ZN....s].......b.i.Y.f.Ns../1..L.Q.Q./...y..y.F.h##..<.j.q.T......?4.U..G...j..wX...^..a.'..............+....m.eH...A.h0A..../.nk.Ze.....a..W.]x....7..[2z.df..Q..;.8.S}.....2.J.W..kR6.c...;.t%..>.NE..xg.S....m.....|.J<gZ04..V!..S.......Z..Nm..2w..).c......R.L. >>...b.,.R[+=. ........K.'..l).f..O..0Nm...>)@6....1.m3..1Dv...G<b..k.B...( I...............0j0...L...V.Q"..l...B.{$....wA..Y.....@EOY]q.o.?.LjR)..K.J!BH...~6.}.~.!9%........tb.7..T.V..D...rV...'.... .M7............]...;en3.Z.y.\HU...C'Jw..zs....u..E..v.....$.)E...4v...E.#..7.n.f.,v.."6...?....Ba .l9.jY3...[.|.....O...f-.......q?c....no..H.D.....,.W.7.F.=......o...{ue..0O.Z...t....;.j6..{...n....^.}..G.m.....Tig.s.TT.Y....`GP.....0.zo).J..b....4.....I...-G.J.x....p.~...\s..........D..k..7..^`.=.It.#.R..Ft.E.R...>..p.(7..@.....jmsu..$.:&C........YbZr.J.i.J.Gjz... X...b...t..L..'.3M|.L....._}..@..8....wE....&L.[...:.q.)3.p.y..>.....v+.....{...}H.&.[.....7..3.

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\PIVFAGEAAV.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.826543814084529
                                                                        Encrypted:false
                                                                        SSDEEP:24:f4c0qHyEONiPW5BwV8rdbzOmmqIY5jaByMUWnJu5O0+anKPSSR6GWbD:N0EyEAiPQ5bzRm457WnJu5P+aKPSljD
                                                                        MD5:2DEB56EB782F7EFD6B8A885D842C4D1E
                                                                        SHA1:35A61C0290A1FC2D289785FEBD599FD6BB18DBA8
                                                                        SHA-256:EA0B7054FE8658B9CBCBF5581DEFB8BA43BF1520C4AA73854AD21F0A47A9529F
                                                                        SHA-512:F27D2C5A24F51738F05C8D6B42435241002806C2A6DA56E38C1E0763152663A73C213487926D3A28E44365FE000CAEC8460EE8030B941EBDF80D84734251991F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.b.R......D..E..07.ZN....s].......b.i.Y.f.Ns../1..L.Q.Q./...y..y.F.h##..<.j.q.T......?4.U..G...j..wX...^..a.'..............+....m.eH...A.h0A..../.nk.Ze.....a..W.]x....7..[2z.df..Q..;.8.S}.....2.J.W..kR6.c...;.t%..>.NE..xg.S....m.....|.J<gZ04..V!..S.......Z..Nm..2w..).c......R.L. >>...b.,.R[+=. ........K.'..l).f..O..0Nm...>)@6....1.m3..1Dv...G<b..k.B...( I...............0j0...L...V.Q"..l...B.{$....wA..Y.....@EOY]q.o.?.LjR)..K.J!BH...~6.}.~.!9%........tb.7..T.V..D...rV...'.... .M7............]...;en3.Z.y.\HU...C'Jw..zs....u..E..v.....$.)E...4v...E.#..7.n.f.,v.."6...?....Ba .l9.jY3...[.|.....O...f-.......q?c....no..H.D.....,.W.7.F.=......o...{ue..0O.Z...t....;.j6..{...n....^.}..G.m.....Tig.s.TT.Y....`GP.....0.zo).J..b....4.....I...-G.J.x....p.~...\s..........D..k..7..^`.=.It.#.R..Ft.E.R...>..p.(7..@.....jmsu..$.:&C........YbZr.J.i.J.Gjz... X...b...t..L..'.3M|.L....._}..@..8....wE....&L.[...:.q.)3.p.y..>.....v+.....{...}H.&.[.....7..3.

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\PWCCAWLGRE.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85718039097883
                                                                        Encrypted:false
                                                                        SSDEEP:24:Vuv95yo/KLg0Px7jxBowvPtcwsMaM8QnAy+lfFuDLE9uvI5Q8CE2Rnc8ZF8Om1sB:VY2Lg0Px7fo++wBaM9AyLAuvw+c8H8Vq
                                                                        MD5:B256DB0F0CCA56391EC6712B28B3A690
                                                                        SHA1:D710408896B6D19DC594BC9A2E39E592C61B5CA1
                                                                        SHA-256:5738F415EE450F7BBADAD2E48FF4E5CA87A3EABE68E16F5E4F08EF1D99B28C3C
                                                                        SHA-512:7E7C051FCF5818E83EF3E5E0BFCD6C4592A8A121AE59049329BC0218B8F3B164883F328D8F26CDB0D73797A512200DACCB098716CF3F32EC7F9BF43CA1C6F8B7
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA....iFX._JnU.v......!.+$~.<..2.x.|.5B..`...ym...c,#.^......d.x+..[.B...c.Y.1.T...*...e@..T..._*..].P.r.<.I...]e.m\....1^.U..+._.S2z.F"..3.ZP.8.].k...Z.=6J.G..].....:.......`7%....N.H.U.lc..........2;2.8....2<U..;..P.lH......p.n...3{.jg.....T........:.5.5F........W6..._.s.<.nbs.L.u..0S8w..\.R..~../.n..O...H.......~.......v.Ot6....Z!.n6}Hb|0....u~.[X.r!.X.... ..L7Z.kA...Jd....b....1....na@..H.^.dZ..a.Rp.tL.....&s.S.3B..F.K...S]..1......0e...N..o.....Vp9...% .c.....QHF..D.e.....F.p..?h.e..J$..........9..FT......i...l.C....6U..e.....p......."nms....Taxw.m..I.3kS7Y.^e.l.y..X.,<...D..V.fPFG....W..`..HIB...M{..,."T..~..p....B....8F........{.&.|..{ ....b.m...R.b...$......7..[Q9u+s..!.p^/}&..3<.BCT.Z.w5J\.2.}..O,...i&#{....9t"do.......B?....U...Z....C......l......*x..J..O..Qe.....r.Y.d.....q.>..R...... ..-...w(&-.+........4..M..G....aB.,.....k:D.#.o.{cG?.m.e....Sd3?`.@b'MS...~.@..G.|....:/.A.@.....k...'4.S.I.8C.T.9.s............5..j.v....b..AH...

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\PWCCAWLGRE.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85718039097883
                                                                        Encrypted:false
                                                                        SSDEEP:24:Vuv95yo/KLg0Px7jxBowvPtcwsMaM8QnAy+lfFuDLE9uvI5Q8CE2Rnc8ZF8Om1sB:VY2Lg0Px7fo++wBaM9AyLAuvw+c8H8Vq
                                                                        MD5:B256DB0F0CCA56391EC6712B28B3A690
                                                                        SHA1:D710408896B6D19DC594BC9A2E39E592C61B5CA1
                                                                        SHA-256:5738F415EE450F7BBADAD2E48FF4E5CA87A3EABE68E16F5E4F08EF1D99B28C3C
                                                                        SHA-512:7E7C051FCF5818E83EF3E5E0BFCD6C4592A8A121AE59049329BC0218B8F3B164883F328D8F26CDB0D73797A512200DACCB098716CF3F32EC7F9BF43CA1C6F8B7
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA....iFX._JnU.v......!.+$~.<..2.x.|.5B..`...ym...c,#.^......d.x+..[.B...c.Y.1.T...*...e@..T..._*..].P.r.<.I...]e.m\....1^.U..+._.S2z.F"..3.ZP.8.].k...Z.=6J.G..].....:.......`7%....N.H.U.lc..........2;2.8....2<U..;..P.lH......p.n...3{.jg.....T........:.5.5F........W6..._.s.<.nbs.L.u..0S8w..\.R..~../.n..O...H.......~.......v.Ot6....Z!.n6}Hb|0....u~.[X.r!.X.... ..L7Z.kA...Jd....b....1....na@..H.^.dZ..a.Rp.tL.....&s.S.3B..F.K...S]..1......0e...N..o.....Vp9...% .c.....QHF..D.e.....F.p..?h.e..J$..........9..FT......i...l.C....6U..e.....p......."nms....Taxw.m..I.3kS7Y.^e.l.y..X.,<...D..V.fPFG....W..`..HIB...M{..,."T..~..p....B....8F........{.&.|..{ ....b.m...R.b...$......7..[Q9u+s..!.p^/}&..3<.BCT.Z.w5J\.2.}..O,...i&#{....9t"do.......B?....U...Z....C......l......*x..J..O..Qe.....r.Y.d.....q.>..R...... ..-...w(&-.+........4..M..G....aB.,.....k:D.#.o.{cG?.m.e....Sd3?`.@b'MS...~.@..G.|....:/.A.@.....k...'4.S.I.8C.T.9.s............5..j.v....b..AH...

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\QNCYCDFIJJ.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.872313616738579
                                                                        Encrypted:false
                                                                        SSDEEP:24:a5JuuRq+RsfJ+cS8yx3aJ5qRGk6gCrDPBl14mCcuq+t0O+TYgiKDuD/pMy1NZWbD:odRshZJyhLGk6HPZlam/uq+LC7siyXmD
                                                                        MD5:C1E977ABF7843EAA8E466C8B91C51BA2
                                                                        SHA1:79243F44752FAF84087C03AF0EA80437D09D678F
                                                                        SHA-256:3A566BF72B6A9ABC225B945DA746ED1AB873B3E35BBDA9C16A3C0BEBDA393E17
                                                                        SHA-512:FAE3E913B888599681BD9B42FC8604D16990592F3B55EFB4485DE4801206CB16E827E018B9993BE88FA319B352A99DCB9425E9A69F7776DFF1A56AE8B11B87CA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYCAk..].....q.{........i~I..6m..7M..E...$....gg.L[....Z.c..H\4y.m|.eB|@.....l.........w.z.<<q......^.E.).q.4...m.....e..K..}.........A..z..[...(..S.'...;..S.e.f..:..G....Z..m.o....1...?...#.+.Q.h./..I.........6..1......].$.MG..52...V....9.j...c..{.f.C....k8w]..)..s.V.....b.e..v...sii(.. .....F^\.{...F.._>.)'.QN.r2.!C.....t...[.......e....,..[Jk.._q...Eg...*x....o.\e.w.1...V0.....'..$`..,....<@y.....W..d....<b../UP......L.j..W...)..........[.`..#..>K...:...........C:.(;_4|.....{.[....c,...(..g%e...r.g>\Kr^ H...c..=.!J.H...Z>......P..P..n?..K8v...:.9.I.. x-w...C..QN..;9......\..r.\...+1....k}.....+o..=)E........<B...+.O.Z.E(.V........l...1.+X.4.;.@.a....,;<..Pzrq....Z%... J..e^.Ea`.s.......v.p#$..kF.K.......V0."\.d.I\i..+....4tIg.1......Nc..]u..`.v,..Z.^3xS~..5.K}.._.{.Y...#y#.}...9D...1.$..N....""..-p..A....l.q......=.,'...../.}tGV.....A..t....V..<#.N.F...c.3....`...'e...F..k...A..%.aY?.ny.....|..>..{@.s.......%i.....b.p,..j

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\QNCYCDFIJJ.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.872313616738579
                                                                        Encrypted:false
                                                                        SSDEEP:24:a5JuuRq+RsfJ+cS8yx3aJ5qRGk6gCrDPBl14mCcuq+t0O+TYgiKDuD/pMy1NZWbD:odRshZJyhLGk6HPZlam/uq+LC7siyXmD
                                                                        MD5:C1E977ABF7843EAA8E466C8B91C51BA2
                                                                        SHA1:79243F44752FAF84087C03AF0EA80437D09D678F
                                                                        SHA-256:3A566BF72B6A9ABC225B945DA746ED1AB873B3E35BBDA9C16A3C0BEBDA393E17
                                                                        SHA-512:FAE3E913B888599681BD9B42FC8604D16990592F3B55EFB4485DE4801206CB16E827E018B9993BE88FA319B352A99DCB9425E9A69F7776DFF1A56AE8B11B87CA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYCAk..].....q.{........i~I..6m..7M..E...$....gg.L[....Z.c..H\4y.m|.eB|@.....l.........w.z.<<q......^.E.).q.4...m.....e..K..}.........A..z..[...(..S.'...;..S.e.f..:..G....Z..m.o....1...?...#.+.Q.h./..I.........6..1......].$.MG..52...V....9.j...c..{.f.C....k8w]..)..s.V.....b.e..v...sii(.. .....F^\.{...F.._>.)'.QN.r2.!C.....t...[.......e....,..[Jk.._q...Eg...*x....o.\e.w.1...V0.....'..$`..,....<@y.....W..d....<b../UP......L.j..W...)..........[.`..#..>K...:...........C:.(;_4|.....{.[....c,...(..g%e...r.g>\Kr^ H...c..=.!J.H...Z>......P..P..n?..K8v...:.9.I.. x-w...C..QN..;9......\..r.\...+1....k}.....+o..=)E........<B...+.O.Z.E(.V........l...1.+X.4.;.@.a....,;<..Pzrq....Z%... J..e^.Ea`.s.......v.p#$..kF.K.......V0."\.d.I\i..+....4tIg.1......Nc..]u..`.v,..Z.^3xS~..5.K}.._.{.Y...#y#.}...9D...1.$..N....""..-p..A....l.q......=.,'...../.}tGV.....A..t....V..<#.N.F...c.3....`...'e...F..k...A..%.aY?.ny.....|..>..{@.s.......%i.....b.p,..j

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\SFPUSAFIOL.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.847851270975423
                                                                        Encrypted:false
                                                                        SSDEEP:24:ff+60mV+9A8lTsjShYjG31pyXbJYps6rjUi951WB6Gsh9EhnHYzf5dLH5dWbD:fd0i86Saj2alYW6HB95e6fh9I4zf5ddC
                                                                        MD5:76D523346129DF1F2C6C546CFB894F98
                                                                        SHA1:55A2CA4BA3DDF5F4F3FFCAF4F68C9AC4591B39E0
                                                                        SHA-256:2A180D8BD9397F6C6254ED14E97DA2924CAD32766229EB77EB9562A1D0C7C1F8
                                                                        SHA-512:1614A51188264EC15A8D2804A0791A5B569D71C75BDCE744038818A42F500D0A39E2878C1A35EE38D3E3FADB943C62B1C2E88523BA012FA5AA64A521B5B52D79
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS/.X.....1)...R..fl.?.~.G.p._ao..7~.Y...{.z......./..*..;[..X......z...&W.U......"......e.p\.i.l,c....b.%%o|..n9i.n>......o.<.$B........^...C..:.K...*h..V~...L....;....>.Z...\.....1..T.ivf...$d)T.[.[.y...p..*...K...A.rK..}.o...'.d.<..t...r.....}.X..u5..o....)d..A.G...j(.S..#)fa%_>T...8.q.g.T.......v.UM.N.,v..........S_..H..'P....j.w..?f...4Q.5.............p.l%.Z..J.!..H.X@p7.... r....$.Ct.G_.&X./...p..s..n.kDM.N...a..p........=..f`........]]......D.zX...q....._b....S....X.8L....T2.qC.T-..YW..Y...E..V<...@'Z.8.....,....P<....w....p|.)&.6`.7..;.f$......hgR$%.$..Y....;..]........"..[..=....jt........QQ.I....n]u..e..s..a%.-...N..m.....1....._...O.VxXj...'ph=...@*.H.C71_...Q.MD<-..lZ.....J!W.....F....G..TnS..@.;..ii..!./..Pn....{..k..x.w^. ..{XJuY....K..GUJ....RVT.k;.......%~...... .O...m6..xVl...x._.L.).G.... ....M.F....O.fq2:5..NWe.,.y.`..1......A9`l.K._..y.v..b;.%..c..d..]..p.....=.F3.8...B..:.($..cP.|&..C.W..^%...s.....2...7.......

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\SFPUSAFIOL.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.847851270975423
                                                                        Encrypted:false
                                                                        SSDEEP:24:ff+60mV+9A8lTsjShYjG31pyXbJYps6rjUi951WB6Gsh9EhnHYzf5dLH5dWbD:fd0i86Saj2alYW6HB95e6fh9I4zf5ddC
                                                                        MD5:76D523346129DF1F2C6C546CFB894F98
                                                                        SHA1:55A2CA4BA3DDF5F4F3FFCAF4F68C9AC4591B39E0
                                                                        SHA-256:2A180D8BD9397F6C6254ED14E97DA2924CAD32766229EB77EB9562A1D0C7C1F8
                                                                        SHA-512:1614A51188264EC15A8D2804A0791A5B569D71C75BDCE744038818A42F500D0A39E2878C1A35EE38D3E3FADB943C62B1C2E88523BA012FA5AA64A521B5B52D79
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS/.X.....1)...R..fl.?.~.G.p._ao..7~.Y...{.z......./..*..;[..X......z...&W.U......"......e.p\.i.l,c....b.%%o|..n9i.n>......o.<.$B........^...C..:.K...*h..V~...L....;....>.Z...\.....1..T.ivf...$d)T.[.[.y...p..*...K...A.rK..}.o...'.d.<..t...r.....}.X..u5..o....)d..A.G...j(.S..#)fa%_>T...8.q.g.T.......v.UM.N.,v..........S_..H..'P....j.w..?f...4Q.5.............p.l%.Z..J.!..H.X@p7.... r....$.Ct.G_.&X./...p..s..n.kDM.N...a..p........=..f`........]]......D.zX...q....._b....S....X.8L....T2.qC.T-..YW..Y...E..V<...@'Z.8.....,....P<....w....p|.)&.6`.7..;.f$......hgR$%.$..Y....;..]........"..[..=....jt........QQ.I....n]u..e..s..a%.-...N..m.....1....._...O.VxXj...'ph=...@*.H.C71_...Q.MD<-..lZ.....J!W.....F....G..TnS..@.;..ii..!./..Pn....{..k..x.w^. ..{XJuY....K..GUJ....RVT.k;.......%~...... .O...m6..xVl...x._.L.).G.... ....M.F....O.fq2:5..NWe.,.y.`..1......A9`l.K._..y.v..b;.%..c..d..]..p.....=.F3.8...B..:.($..cP.|&..C.W..^%...s.....2...7.......

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.830028159666871
                                                                        Encrypted:false
                                                                        SSDEEP:24:ptRLkmUjEwl3vcyXj04OD1Etiy6FvnIVaOxk7qaPRva2mYrKgS108cioOWbD:0jrlf1h+EN6Fv4aOy7qaP9a2mYGTeZ7D
                                                                        MD5:1D909D06F3C893C9338579AA6DE3EBDA
                                                                        SHA1:F566E1F6E69787064C1440F3BBC8A7AACC887E6D
                                                                        SHA-256:1884F805DCDE61133E06E98FA3F90C4929F6B4194AC18B0406AB684724DAA886
                                                                        SHA-512:C981FBF0098FF2E5B52AFC1DFD66BCE9826D7FF7098977C073689CBA33307C6C1448D85DBC1D37DD03917702F28A4DBB54E8E311BE5F4E92840EC8FB8FBD76BD
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ZQIXM.-...9O..9....=.Tk...m....d.}..l...*..2t..+....T.fc.h..c..Y..........Q...Zj+......pv1...,..H'y.s..noH...*....X...7.m..F+...j{....>.[-e....S...../LjW..0..uCet..p#&.oi..g.E..../...9..~*.-.....5....!x.3.a....X......@.-.b....B...).>);.}....&..W.5O_.yz....)....!X&....u4.Jp3`...0.g..S.E..(.>.[CC....;.i..cD.,...`......K V...........W..p2../..8 ..~...`..JXV........gp.V...{....g4....s0.....!d..f...j0...a...H.'..x...`.....}K]..."..;'+AD....K...7...)..x.G.....9..aB...'{c...'.9].@......I...0..x...(.....e..:..Z4k.mg. ...!.H..b..X....).ZZ.......?.i...>.F..?...W.bT./..Q.T..i.H..pJ......c....k..N.....G.q5(j0aQM.M....H...N..3..j...n...D6....D....'^.&...<.1.m1T....&dZ.[!.lWo.9...X...#.os.e..{Q.y}6.h2.<P4.aW...O.......CCDQ~;8..B...[4.`.......{A...C..*...S..nW..x.m\...,.."...p.m.w9.3w....- .*.....2L...:0.v..]]...Z.a...i@.... .......J.....(..L3.Z..z.....(.P.p..4...Ii.G...p..v.._............p...W..]1...J.<],yn...y.&.m.CY.H.@. .....k.wT..+n..8.l..s..

                                                                        C:\Users\user\Desktop\SFPUSAFIOL\ZQIXMVQGAH.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.830028159666871
                                                                        Encrypted:false
                                                                        SSDEEP:24:ptRLkmUjEwl3vcyXj04OD1Etiy6FvnIVaOxk7qaPRva2mYrKgS108cioOWbD:0jrlf1h+EN6Fv4aOy7qaP9a2mYGTeZ7D
                                                                        MD5:1D909D06F3C893C9338579AA6DE3EBDA
                                                                        SHA1:F566E1F6E69787064C1440F3BBC8A7AACC887E6D
                                                                        SHA-256:1884F805DCDE61133E06E98FA3F90C4929F6B4194AC18B0406AB684724DAA886
                                                                        SHA-512:C981FBF0098FF2E5B52AFC1DFD66BCE9826D7FF7098977C073689CBA33307C6C1448D85DBC1D37DD03917702F28A4DBB54E8E311BE5F4E92840EC8FB8FBD76BD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.-...9O..9....=.Tk...m....d.}..l...*..2t..+....T.fc.h..c..Y..........Q...Zj+......pv1...,..H'y.s..noH...*....X...7.m..F+...j{....>.[-e....S...../LjW..0..uCet..p#&.oi..g.E..../...9..~*.-.....5....!x.3.a....X......@.-.b....B...).>);.}....&..W.5O_.yz....)....!X&....u4.Jp3`...0.g..S.E..(.>.[CC....;.i..cD.,...`......K V...........W..p2../..8 ..~...`..JXV........gp.V...{....g4....s0.....!d..f...j0...a...H.'..x...`.....}K]..."..;'+AD....K...7...)..x.G.....9..aB...'{c...'.9].@......I...0..x...(.....e..:..Z4k.mg. ...!.H..b..X....).ZZ.......?.i...>.F..?...W.bT./..Q.T..i.H..pJ......c....k..N.....G.q5(j0aQM.M....H...N..3..j...n...D6....D....'^.&...<.1.m1T....&dZ.[!.lWo.9...X...#.os.e..{Q.y}6.h2.<P4.aW...O.......CCDQ~;8..B...[4.`.......{A...C..*...S..nW..x.m\...,.."...p.m.w9.3w....- .*.....2L...:0.v..]]...Z.a...i@.... .......J.....(..L3.Z..z.....(.P.p..4...Ii.G...p..v.._............p...W..]1...J.<],yn...y.&.m.CY.H.@. .....k.wT..+n..8.l..s..

                                                                        C:\Users\user\Desktop\ZQIXMVQGAH.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.836391344394786
                                                                        Encrypted:false
                                                                        SSDEEP:24:xWP2eyZ8Kwf6PLfOx6s+zIga8va3FbJ7XBxzmLxi3zn0bWbD:U+IV8+6p/va1bJ7XBxCLE3zn0oD
                                                                        MD5:9F1D1C27AD592D1B5411042E05065668
                                                                        SHA1:6B11F8D809C5A3BEF30FF2C65BAFC83B6AA5DAF9
                                                                        SHA-256:809E6DDADB2B0A0903FAC0134E4CB922DEE1B4FB51368B092365BD8C6E4825AB
                                                                        SHA-512:ADDA7771490F6FF4148C8B4BA66FF48465B03D816D5F83687078F31569B47E269DB03A1558DB2A1F4687AAB2A0E7B001335622C4F23241A98FC115DA60E195AF
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMH...]..*.+>..d.iF.s.W...6...ZW[....5.y....3L6&@.v.)iY3`|...<1.B<...[w...4-......t|...........3..y.*.......(<....a.]......K.......p.#.....r.X.}f..-.'..W....j.g....'..N,......F.v|..NDU>v.,..,.../.7.$......|.7..l..C......{)e.r....`..V3GS.8ltU..E...9(.7Qs5h=..W....r...u;.G.........t|(.d..Bk2...L..x..i.c..dlrl.F.....a..;....<.,,.[.7.f...F.:6...-'.X.&.1...K.A...{$Uu.ir.....A{T.m%l.7.u.@U<.......JP....!..=.....1..!..../U..q...#.+.g...%........5&L8..!U...l...?R.pF4....r...SS.$.5GA.q.&]3...BmK.....q.*.....>p......u..E....:.H...d.EgI.,.l..e...7....;....,....va.<x.....Hn{....%L+1C.W..Z....s'5....=. ^......b|..:.k5...u.5<.D......T....-.b-.W.m.k..{.K...2`3N....Z`.v.......]..*..r".w.....k[....d..I.G.$6...8.Y..0C0...1+.4&-.K.b....q.....^.L.........@.b^.H..:..u....?...h..k....lC..1gg..(ag.b.k.Z6.!..8..-E....~e.=......a..y..Z...b...+.h..W.7.......<J.......S.P..I.Zm.....=.G.....X.a.I.2h..-.~...W..Z..z%..y.R.......Cl..n..&40..R...V..R..A.u...}. .L..

                                                                        C:\Users\user\Desktop\ZQIXMVQGAH.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.836391344394786
                                                                        Encrypted:false
                                                                        SSDEEP:24:xWP2eyZ8Kwf6PLfOx6s+zIga8va3FbJ7XBxzmLxi3zn0bWbD:U+IV8+6p/va1bJ7XBxCLE3zn0oD
                                                                        MD5:9F1D1C27AD592D1B5411042E05065668
                                                                        SHA1:6B11F8D809C5A3BEF30FF2C65BAFC83B6AA5DAF9
                                                                        SHA-256:809E6DDADB2B0A0903FAC0134E4CB922DEE1B4FB51368B092365BD8C6E4825AB
                                                                        SHA-512:ADDA7771490F6FF4148C8B4BA66FF48465B03D816D5F83687078F31569B47E269DB03A1558DB2A1F4687AAB2A0E7B001335622C4F23241A98FC115DA60E195AF
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMH...]..*.+>..d.iF.s.W...6...ZW[....5.y....3L6&@.v.)iY3`|...<1.B<...[w...4-......t|...........3..y.*.......(<....a.]......K.......p.#.....r.X.}f..-.'..W....j.g....'..N,......F.v|..NDU>v.,..,.../.7.$......|.7..l..C......{)e.r....`..V3GS.8ltU..E...9(.7Qs5h=..W....r...u;.G.........t|(.d..Bk2...L..x..i.c..dlrl.F.....a..;....<.,,.[.7.f...F.:6...-'.X.&.1...K.A...{$Uu.ir.....A{T.m%l.7.u.@U<.......JP....!..=.....1..!..../U..q...#.+.g...%........5&L8..!U...l...?R.pF4....r...SS.$.5GA.q.&]3...BmK.....q.*.....>p......u..E....:.H...d.EgI.,.l..e...7....;....,....va.<x.....Hn{....%L+1C.W..Z....s'5....=. ^......b|..:.k5...u.5<.D......T....-.b-.W.m.k..{.K...2`3N....Z`.v.......]..*..r".w.....k[....d..I.G.$6...8.Y..0C0...1+.4&-.K.b....q.....^.L.........@.b^.H..:..u....?...h..k....lC..1gg..(ag.b.k.Z6.!..8..-E....~e.=......a..y..Z...b...+.h..W.7.......<J.......S.P..I.Zm.....=.G.....X.a.I.2h..-.~...W..Z..z%..y.R.......Cl..n..&40..R...V..R..A.u...}. .L..

                                                                        C:\Users\user\Desktop\ZQIXMVQGAH.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85227376026555
                                                                        Encrypted:false
                                                                        SSDEEP:24:LOIwHahiGbfRs4a+K+0xqPtKwg2gf+ybZrxtccgpflopMlWXr9hqy43E3fPWbD:i1aZHa+KxcPtVg2+j1woZqy43IcD
                                                                        MD5:F6118968164F24867CBA72D9CAE31B4C
                                                                        SHA1:339F7287272F7E5A142EA5CE3FE00BAE20C741FA
                                                                        SHA-256:E6B08E47C7DE6170B130F66DAB2BFF8F3F0EFE0265ECFC802A9CE849501933E7
                                                                        SHA-512:A20B029C25C119ADF7FA8F20DEE8EC5910503119B6DE38DF156751E409C13326D4758E041220ABB8C8A6B16FF5BBA18EAD46D80277C9C5F69B3BC2675BE92DF3
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMB..A.I....C..[c.K.9#...5.T.g..].:n..S.b.... b...9..xCnb..23@..Q...vbb.r&.3.#....:.O.c.8.3V.k.c.U...U....\.>.'....m.2.Vr.R$.y....|@ZH..KeX........(..~Q..YS...Vv..}(...........!.n.aT.v..^.])[a...D@k...] <..w...=...v.t.=,S......X.....F.\cn#.:.....\..J...!7.d.k./....<T*ZDU..OV.../...D2....3.K.x.u@...+..y.6.s.7N.8....Q25Z..ts.c[F..2(.<.!BG.....G.\....je.K#..bA..f.....p...o0.u.]...Y4.W......j.>..CJ..!.g..z.{X..|.o.....5..n.=....7G^..C./h.m...,..pw<.b..t./.P.....S.zZ..a.....`.<...2.....8.K]......-3..:.g.I&KY.................B+.f_S......*.....huK.FU..(O..j.N..^\.w..(....r.......U+_..t._l.... *.\..:!g...Z..?..84..._V...{m..*..{....bF%(........G.{.;..C....H...!SG.W......t..smy..`.......=?......?....N..c.B.^..Fs2a...u.....|.^.."I]h..~............4....OO..,G...3X=.=>..K.;%...]......-..]..q.F.H.0...../O..\T..n.\....ePB.V.q.v-..W.a...............+N\?r..p.......6....RC.K;.@,..L......+..Qv.....1..vu7r..[IZ.h]...{Y.qU.D.......Y.$..d..O.@

                                                                        C:\Users\user\Desktop\ZQIXMVQGAH.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85227376026555
                                                                        Encrypted:false
                                                                        SSDEEP:24:LOIwHahiGbfRs4a+K+0xqPtKwg2gf+ybZrxtccgpflopMlWXr9hqy43E3fPWbD:i1aZHa+KxcPtVg2+j1woZqy43IcD
                                                                        MD5:F6118968164F24867CBA72D9CAE31B4C
                                                                        SHA1:339F7287272F7E5A142EA5CE3FE00BAE20C741FA
                                                                        SHA-256:E6B08E47C7DE6170B130F66DAB2BFF8F3F0EFE0265ECFC802A9CE849501933E7
                                                                        SHA-512:A20B029C25C119ADF7FA8F20DEE8EC5910503119B6DE38DF156751E409C13326D4758E041220ABB8C8A6B16FF5BBA18EAD46D80277C9C5F69B3BC2675BE92DF3
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMB..A.I....C..[c.K.9#...5.T.g..].:n..S.b.... b...9..xCnb..23@..Q...vbb.r&.3.#....:.O.c.8.3V.k.c.U...U....\.>.'....m.2.Vr.R$.y....|@ZH..KeX........(..~Q..YS...Vv..}(...........!.n.aT.v..^.])[a...D@k...] <..w...=...v.t.=,S......X.....F.\cn#.:.....\..J...!7.d.k./....<T*ZDU..OV.../...D2....3.K.x.u@...+..y.6.s.7N.8....Q25Z..ts.c[F..2(.<.!BG.....G.\....je.K#..bA..f.....p...o0.u.]...Y4.W......j.>..CJ..!.g..z.{X..|.o.....5..n.=....7G^..C./h.m...,..pw<.b..t./.P.....S.zZ..a.....`.<...2.....8.K]......-3..:.g.I&KY.................B+.f_S......*.....huK.FU..(O..j.N..^\.w..(....r.......U+_..t._l.... *.\..:!g...Z..?..84..._V...{m..*..{....bF%(........G.{.;..C....H...!SG.W......t..smy..`.......=?......?....N..c.B.^..Fs2a...u.....|.^.."I]h..~............4....OO..,G...3X=.=>..K.;%...]......-..]..q.F.H.0...../O..\T..n.\....ePB.V.q.v-..W.a...............+N\?r..p.......6....RC.K;.@,..L......+..Qv.....1..vu7r..[IZ.h]...{Y.qU.D.......Y.$..d..O.@

                                                                        C:\Users\user\Desktop\ZQIXMVQGAH.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.845125562876626
                                                                        Encrypted:false
                                                                        SSDEEP:24:KTMv1Zlk36ygKevzkK4mTVDKdQ0Juv+bU8nI/9Z2iSUD2EO6/ZuH3CLWbD:KIv1ZYgQK4EuCAuv+zQ2iSUKE3/ZuH3P
                                                                        MD5:B76C3CD024325C8FD098CEA8EA8EA7D1
                                                                        SHA1:1D076FC54EC7FB631380E80ECDFCB5C16B34B495
                                                                        SHA-256:AE3D60ECC48186488B2D5F033DBF304B611AE32F3E65369C7DB1BB63BA73DAD9
                                                                        SHA-512:ED4650BB8C5CB14140EFD9B432E2E94BCF095EEB25BDBF5C1043AB7F25526326B0471E679CAD881963D52F3A064EDB4B79D11AA0FC620FAFFD0C7CA2B3B9D973
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ZQIXMY.]>.......n[...Yf...+...N=Mk.T.z.].2..O.+.6e..m..)!.n">.p{..i.....9o..N.n.X......sQ..m. S.9R...^Ng.x....'0.8....-...e..W.F@^B..m...Y.).hg.dP..VnI.=C.TN.w. ..m..C...O.....f....4/.}U3..n.Q..._..U..s<..RMbG..~WH........6...t.z.......\.......2.a.S...y...4o.L.:.(..7.mj.}D.QgA..?{.f..Sj..@u...`...J....pi.......@....~>}.,..'.1.5..S..O.a...i.._...Ol....p2..Cbd.....X..)..K..H.n ...._.F.E:).P..x. J.`....R.}.=....Y.:.A?M..o.RX..;.......K....)*....f_..o...3E|7.........P..p:...|~E...D.R..vs.(....gN....<J.....E.z.D.3.X....4'"],*.......`S.t..j<...KS....< ..Z......e.ds...I.. ....s...4H4.n.........r4.=A.?....K&..B.....>^G...Ws&k.d......H....)....9..Xp.;......c[......>.6*.....`....pp...\| .\}.]..X...n.s..j...X.~....;8.....u....E..;p8.7..z.Z.....y....l.9...U....4..5...2..L............k.../?zT.....8.....K..a.y...U.d..,&.#X..].n.C\..h.p..EupTv+........%...(-v<..?......eOA~..SS.....K...*.........[Y..n.W..q.>c,.H.I....A....@..n_B.z..*.B..K.....k.dd...(I...h.

                                                                        C:\Users\user\Desktop\ZQIXMVQGAH.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.845125562876626
                                                                        Encrypted:false
                                                                        SSDEEP:24:KTMv1Zlk36ygKevzkK4mTVDKdQ0Juv+bU8nI/9Z2iSUD2EO6/ZuH3CLWbD:KIv1ZYgQK4EuCAuv+zQ2iSUKE3/ZuH3P
                                                                        MD5:B76C3CD024325C8FD098CEA8EA8EA7D1
                                                                        SHA1:1D076FC54EC7FB631380E80ECDFCB5C16B34B495
                                                                        SHA-256:AE3D60ECC48186488B2D5F033DBF304B611AE32F3E65369C7DB1BB63BA73DAD9
                                                                        SHA-512:ED4650BB8C5CB14140EFD9B432E2E94BCF095EEB25BDBF5C1043AB7F25526326B0471E679CAD881963D52F3A064EDB4B79D11AA0FC620FAFFD0C7CA2B3B9D973
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMY.]>.......n[...Yf...+...N=Mk.T.z.].2..O.+.6e..m..)!.n">.p{..i.....9o..N.n.X......sQ..m. S.9R...^Ng.x....'0.8....-...e..W.F@^B..m...Y.).hg.dP..VnI.=C.TN.w. ..m..C...O.....f....4/.}U3..n.Q..._..U..s<..RMbG..~WH........6...t.z.......\.......2.a.S...y...4o.L.:.(..7.mj.}D.QgA..?{.f..Sj..@u...`...J....pi.......@....~>}.,..'.1.5..S..O.a...i.._...Ol....p2..Cbd.....X..)..K..H.n ...._.F.E:).P..x. J.`....R.}.=....Y.:.A?M..o.RX..;.......K....)*....f_..o...3E|7.........P..p:...|~E...D.R..vs.(....gN....<J.....E.z.D.3.X....4'"],*.......`S.t..j<...KS....< ..Z......e.ds...I.. ....s...4H4.n.........r4.=A.?....K&..B.....>^G...Ws&k.d......H....)....9..Xp.;......c[......>.6*.....`....pp...\| .\}.]..X...n.s..j...X.~....;8.....u....E..;p8.7..z.Z.....y....l.9...U....4..5...2..L............k.../?zT.....8.....K..a.y...U.d..,&.#X..].n.C\..h.p..EupTv+........%...(-v<..?......eOA~..SS.....K...*.........[Y..n.W..q.>c,.H.I....A....@..n_B.z..*.B..K.....k.dd...(I...h.

                                                                        C:\Users\user\Documents\EEGWXUHVUG.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.854259164885571
                                                                        Encrypted:false
                                                                        SSDEEP:24:mPPSaZqpH4dXo8YQTalkoLYhCIlyZGjV47dcScZnR3dw1MEyT3T4JMc/Tm35WbD:mHSaKHEzjTalko8hCIly6V2InR3dXE+y
                                                                        MD5:B082251F1D117C788E704DA19A5023A3
                                                                        SHA1:937B7FF1B199C268DB631854B8889A466123B113
                                                                        SHA-256:FC69DB0FE7E7E1D80A2A941A8F915B31A0717FD903717509C582787D02A208EB
                                                                        SHA-512:13F2F6C592876C6136A55568F787204B304727E4270FECBC0BBCC45A12C5211361893B03CF082CB39894A8A4FAAE0308C4AB25A02D89FFD29055928F9C9DB920
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWXi...@2~.&..#.`...w.M.# P..7DT.l.0.H.%~.^.v(.gw(.=.o..D1..#.....h..z...Sw.5..{v..O>z.W.r.<.2........K.v....6.....H..Z..D...-6.|....t.>}iqgW...s.......P........6...>.'/O.Q~J.k.[9...J..Ya...|.(.H..K.&.9.Fb""..p.%.~S...2.....F.A.As.V......zzV.c.........E.y.Bc}.L...r.EcW..Eaa{.zc.fX.....~..\.=..-...=.q.>]U`%l.../4.=.^a..JWs...d..gcd[..(wC..J..[X..:...5VRD&..a...}.....*V.{.H%.-...$.Fg8.'.....t.u......L......a.:....n=..9h..^..f..<r.&...#...e..(a............?t\........g....vtG...E......G....1.".9..,.."......}..N..~..7_.3*.66,iB..N..^A..a.tz"n......K.X.cb.a..x.q......R..y[..p.....|.e..VS.`..H...*.#j.C.gT..Z.!`v..._..0....F..#B..{..(...;.k....[..RR..?.Q.........p(v7..q....W.m.j.........N.c.O...........)D.:.....w.l...10..u.e.h....6&$[,..t....7...$/T..OV'/..O0..6....o...L....C.$?.?^.G6..m.Q.r..\d..i.....R~.Xyw.l.|..n.6}..=I.X......@......(...-=J..q=...'....[ .....x!..[.wv.s.vuZ.v......a|...R.).Ah...A....*iG..c'C`.d.D....<...._.9.n..y.$.

                                                                        C:\Users\user\Documents\EEGWXUHVUG.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.854259164885571
                                                                        Encrypted:false
                                                                        SSDEEP:24:mPPSaZqpH4dXo8YQTalkoLYhCIlyZGjV47dcScZnR3dw1MEyT3T4JMc/Tm35WbD:mHSaKHEzjTalko8hCIly6V2InR3dXE+y
                                                                        MD5:B082251F1D117C788E704DA19A5023A3
                                                                        SHA1:937B7FF1B199C268DB631854B8889A466123B113
                                                                        SHA-256:FC69DB0FE7E7E1D80A2A941A8F915B31A0717FD903717509C582787D02A208EB
                                                                        SHA-512:13F2F6C592876C6136A55568F787204B304727E4270FECBC0BBCC45A12C5211361893B03CF082CB39894A8A4FAAE0308C4AB25A02D89FFD29055928F9C9DB920
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWXi...@2~.&..#.`...w.M.# P..7DT.l.0.H.%~.^.v(.gw(.=.o..D1..#.....h..z...Sw.5..{v..O>z.W.r.<.2........K.v....6.....H..Z..D...-6.|....t.>}iqgW...s.......P........6...>.'/O.Q~J.k.[9...J..Ya...|.(.H..K.&.9.Fb""..p.%.~S...2.....F.A.As.V......zzV.c.........E.y.Bc}.L...r.EcW..Eaa{.zc.fX.....~..\.=..-...=.q.>]U`%l.../4.=.^a..JWs...d..gcd[..(wC..J..[X..:...5VRD&..a...}.....*V.{.H%.-...$.Fg8.'.....t.u......L......a.:....n=..9h..^..f..<r.&...#...e..(a............?t\........g....vtG...E......G....1.".9..,.."......}..N..~..7_.3*.66,iB..N..^A..a.tz"n......K.X.cb.a..x.q......R..y[..p.....|.e..VS.`..H...*.#j.C.gT..Z.!`v..._..0....F..#B..{..(...;.k....[..RR..?.Q.........p(v7..q....W.m.j.........N.c.O...........)D.:.....w.l...10..u.e.h....6&$[,..t....7...$/T..OV'/..O0..6....o...L....C.$?.?^.G6..m.Q.r..\d..i.....R~.Xyw.l.|..n.6}..=I.X......@......(...-=J..q=...'....[ .....x!..[.wv.s.vuZ.v......a|...R.).Ah...A....*iG..c'C`.d.D....<...._.9.n..y.$.

                                                                        C:\Users\user\Documents\GRXZDKKVDB.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.833178251055015
                                                                        Encrypted:false
                                                                        SSDEEP:24:H98AIjR2+v8lfHzRfisXMR0O09gVxHsRtHXCVG6+F3NKVP9I3k//ynlSWsWbD:H9MRyFHVfisXMdsIORdyVG6+dNIPelSI
                                                                        MD5:94955A1241DB86AB3F523C685EF498F1
                                                                        SHA1:2E7614A511FE617DBC62BD4214CB12A77E7B29A0
                                                                        SHA-256:826F4FE993566943EBB21EA388B39936AA2A9F28F02E726552ED1F82D6733336
                                                                        SHA-512:4F3478F6F85EA10EAB42C448100184B5B32BC4563B3E800C7A976EB9CE21CB5429E490AD5235308DA48A2039603FCB038796E2AFD88CCC92809263487D2D92DA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD..n[.X:.0............,...C..........f............v|.4zl...1.U......R7..67.V....{gz..AeX.H.`v..2....S.BR%.......J..D...%..h...M.Y.;{..F...D.n$...V..:.,.*9.F,."...i.jh7..s.W..H...........P.MQ^ ..H..Ev.~.-.UM.F.. ;.#......!.........J....v...7.M...Eu3...up.~...-.m..?B.v.iG..W.....3.]?...w4.'4"a..h.......1?.z..Jf.W.#.......W...e....8}.u4..K.z...S.X..GQ..5..h......$..k...}.c.%....Qz..@..b.e.].m:...b...#.....3..Q.E.-..f.q.?n. ...C...}X.......5..&.N.av5..i..B..&...X...K`D...*&Ai......{...e.,.0.w.(....~C..0...Y`..l.E..../[. b..N..-....m.Q.7..a.%t9.`.K.n&..C.P.Uj.p.ZO..B.fB.z[.=.K...9.>..d.'#]..T.. a4;S.`!.......]H..^.s.d%......2.....K..Zr..........2...."4.....}A......@.e-...V...z.e.c~...K.8..].r...k,p&...bZ..^%.}_./.......:..d..9...K.CG..y4:..K.q'PkJ..S...0....f...sAC.u..-........$o%........[i..1!.......l....]..2......&.,.q2wd..$.}......c.L.2..06 ....g2....hy.l)..G...A.D...*..>.N.. ....].9../.=Z..V..PvS...bV.............j...*

                                                                        C:\Users\user\Documents\GRXZDKKVDB.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.833178251055015
                                                                        Encrypted:false
                                                                        SSDEEP:24:H98AIjR2+v8lfHzRfisXMR0O09gVxHsRtHXCVG6+F3NKVP9I3k//ynlSWsWbD:H9MRyFHVfisXMdsIORdyVG6+dNIPelSI
                                                                        MD5:94955A1241DB86AB3F523C685EF498F1
                                                                        SHA1:2E7614A511FE617DBC62BD4214CB12A77E7B29A0
                                                                        SHA-256:826F4FE993566943EBB21EA388B39936AA2A9F28F02E726552ED1F82D6733336
                                                                        SHA-512:4F3478F6F85EA10EAB42C448100184B5B32BC4563B3E800C7A976EB9CE21CB5429E490AD5235308DA48A2039603FCB038796E2AFD88CCC92809263487D2D92DA
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD..n[.X:.0............,...C..........f............v|.4zl...1.U......R7..67.V....{gz..AeX.H.`v..2....S.BR%.......J..D...%..h...M.Y.;{..F...D.n$...V..:.,.*9.F,."...i.jh7..s.W..H...........P.MQ^ ..H..Ev.~.-.UM.F.. ;.#......!.........J....v...7.M...Eu3...up.~...-.m..?B.v.iG..W.....3.]?...w4.'4"a..h.......1?.z..Jf.W.#.......W...e....8}.u4..K.z...S.X..GQ..5..h......$..k...}.c.%....Qz..@..b.e.].m:...b...#.....3..Q.E.-..f.q.?n. ...C...}X.......5..&.N.av5..i..B..&...X...K`D...*&Ai......{...e.,.0.w.(....~C..0...Y`..l.E..../[. b..N..-....m.Q.7..a.%t9.`.K.n&..C.P.Uj.p.ZO..B.fB.z[.=.K...9.>..d.'#]..T.. a4;S.`!.......]H..^.s.d%......2.....K..Zr..........2...."4.....}A......@.e-...V...z.e.c~...K.8..].r...k,p&...bZ..^%.}_./.......:..d..9...K.CG..y4:..K.q'PkJ..S...0....f...sAC.u..-........$o%........[i..1!.......l....]..2......&.,.q2wd..$.}......c.L.2..06 ....g2....hy.l)..G...A.D...*..>.N.. ....].9../.=Z..V..PvS...bV.............j...*

                                                                        C:\Users\user\Documents\IPKGELNTQY.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.837478623265905
                                                                        Encrypted:false
                                                                        SSDEEP:24:ZMO/QI5U6C/WBVbSoGfkU//0sufHziUHgTjlP0SXeGmh5Rnnek0ZVxXj9WbD:ZMau60a5KZpufOUad0SBoELOD
                                                                        MD5:D9A627C5013E34BF8D3AABFA4F1B5E9B
                                                                        SHA1:64D2009BDEE78EF8BB28AF89E6FF92D20A7E2D36
                                                                        SHA-256:999CB9FC5DC6A2AE910DF3482E2D529CA837435C010B55406D04379AE50F5EA9
                                                                        SHA-512:7BA3C7CB18BCA973325D2819C18D6209E2F364959D532BAA5C534ED15425AC354601D10A54C366692DCF76A9A20FAB855D6D38AD7F08625F5218597E10944C1B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.....n..x.mH.5.....X..D....}@.W..N...fnX..E.T...$.+yC.I.#EG....0..')....O..5........w..... ...lh.!.;.......o.-../V......m.&rfC.#3.J._@...xE5.'....n+.HY...)..k.cH....<*a...l..6..E..........S........6%\p.Q....8a...k..G........k<..s.:....q....'.6....Zs...q#F.. .../;.n.0QH.....5..v..V...b.!..98......m#..}m...S....E.....p..N....t'Y..|..E...Q..........\.xy..H.S.,.i..XW.E.2.....`.9.h.W...I...~..Q+l..%...Oui.d@..c.$Me5.b.Mj...X.l..8@...Q.1.....}....'>v....Qn..6.N....:.!.fW.!{rb...X&.`E.....Z...^.k..|....g..j2.*....@)Nz...-(...Q[<.RU.....&.}....t}.}*%...>5..s.2.UdZ..*........z-.|.-...*..).k&s..r..x.....A.k...,.6RO5_ijU..U..X..DI...Nl#.X....y.......t..i.)1..f.{...{....be..!..NL..~.%.A...I.....B.,.O..C.....\.y!.Po.8..l..,..D.h..3.`.M..o.O]=3..Ahr!.".&...N.wL.bP..G....V...............!..7....c@...Fy]......86*/.8....u...D&...-B.W..:....xz.E...c..B.lCw.../|0..^xn....K..-...?..\..I.FQ..2....#N.C..^D.........8l. .{.*.'._..b...%.P.G..m...M\AO.

                                                                        C:\Users\user\Documents\IPKGELNTQY.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.837478623265905
                                                                        Encrypted:false
                                                                        SSDEEP:24:ZMO/QI5U6C/WBVbSoGfkU//0sufHziUHgTjlP0SXeGmh5Rnnek0ZVxXj9WbD:ZMau60a5KZpufOUad0SBoELOD
                                                                        MD5:D9A627C5013E34BF8D3AABFA4F1B5E9B
                                                                        SHA1:64D2009BDEE78EF8BB28AF89E6FF92D20A7E2D36
                                                                        SHA-256:999CB9FC5DC6A2AE910DF3482E2D529CA837435C010B55406D04379AE50F5EA9
                                                                        SHA-512:7BA3C7CB18BCA973325D2819C18D6209E2F364959D532BAA5C534ED15425AC354601D10A54C366692DCF76A9A20FAB855D6D38AD7F08625F5218597E10944C1B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.....n..x.mH.5.....X..D....}@.W..N...fnX..E.T...$.+yC.I.#EG....0..')....O..5........w..... ...lh.!.;.......o.-../V......m.&rfC.#3.J._@...xE5.'....n+.HY...)..k.cH....<*a...l..6..E..........S........6%\p.Q....8a...k..G........k<..s.:....q....'.6....Zs...q#F.. .../;.n.0QH.....5..v..V...b.!..98......m#..}m...S....E.....p..N....t'Y..|..E...Q..........\.xy..H.S.,.i..XW.E.2.....`.9.h.W...I...~..Q+l..%...Oui.d@..c.$Me5.b.Mj...X.l..8@...Q.1.....}....'>v....Qn..6.N....:.!.fW.!{rb...X&.`E.....Z...^.k..|....g..j2.*....@)Nz...-(...Q[<.RU.....&.}....t}.}*%...>5..s.2.UdZ..*........z-.|.-...*..).k&s..r..x.....A.k...,.6RO5_ijU..U..X..DI...Nl#.X....y.......t..i.)1..f.{...{....be..!..NL..~.%.A...I.....B.,.O..C.....\.y!.Po.8..l..,..D.h..3.`.M..o.O]=3..Ahr!.".&...N.wL.bP..G....V...............!..7....c@...Fy]......86*/.8....u...D&...-B.W..:....xz.E...c..B.lCw.../|0..^xn....K..-...?..\..I.FQ..2....#N.C..^D.........8l. .{.*.'._..b...%.P.G..m...M\AO.

                                                                        C:\Users\user\Documents\IPKGELNTQY.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.821511342827406
                                                                        Encrypted:false
                                                                        SSDEEP:24:k4EpVzWcx8FWTC1dX5ZxN565Dcmkyr59k5jsHYVF4ZOOWptTbPgCNLJBDLm1LKrQ:k4EpxWc6YO/pZxX65nP91HQdpxRJBT4D
                                                                        MD5:CF65021C396F26FAD40678E261650C1B
                                                                        SHA1:41844E92A7C181065E63BA71D94E800116930AE9
                                                                        SHA-256:EAE10B23DDF3952E6DECE261536D12867B19DA14F6FC946B7D255383BB543809
                                                                        SHA-512:C3B299F8A021F17315075F82CF94A7914263697343010A164161F5236C3C4F85974B49CB41F74699957659060ABAC7CB3D4DB4505E22B4F04089877F6E44D3A4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE....j`.:.-V.b....G......Y....A.>.3K...SR.M.>.Wp.....h...p..n......N....fE...a{.D.dq...:....5qT...r..dq.....<....ej..w..........E.'dOL&...f....C..U....o`.M...T.U.S...(.r...r.B.e.....0..b.._..Ci.....g.J..W..(..!.l.er.mu..I.b*q.j.(.k<..YZ..}.6..\f.I.!.........m:.x...IBv`...z.. Ut.OF...*j^.d......^m-.znr^..{.P.h...U(....w...S[.]..T..g..............<.~k......&Dm6...%...*u.!.S6W.k.t.~..-{..72.`...l.T...h......d...6a.=....1..v}.j...R.JU{+..]..q~.j...]p.H)...V..&...ka:.....]...p..X.....K0....#.0.N....j...S.r+HC.c.=T.vs]jR\Af....|A?2.w..Z.g...Ij..iv.g..W..S...$=..v#C...c._+........6.5..H...7"....n<.W.....n.....,.B....N.........|..>.d&D.....B...R.....dF.....0.l...(}...5.5..Q...v....^.......~....Z..=..+.....A.b]J6./gS...V...'......qLD6<.......V...-.J...:/..:.2..>,...J..D.zF...S.D..<".U.Zo...yb...^.G...W6.X.....N....<1q!s.....w...D..v._.....Z.f=..6Y..Peh....eg..wC^....5.@..x......E.(...$..q]..{..q9B.....i.~..../..u.&..5A.r.Z2.9.JxJ.jH1b.]..z....

                                                                        C:\Users\user\Documents\IPKGELNTQY.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.821511342827406
                                                                        Encrypted:false
                                                                        SSDEEP:24:k4EpVzWcx8FWTC1dX5ZxN565Dcmkyr59k5jsHYVF4ZOOWptTbPgCNLJBDLm1LKrQ:k4EpxWc6YO/pZxX65nP91HQdpxRJBT4D
                                                                        MD5:CF65021C396F26FAD40678E261650C1B
                                                                        SHA1:41844E92A7C181065E63BA71D94E800116930AE9
                                                                        SHA-256:EAE10B23DDF3952E6DECE261536D12867B19DA14F6FC946B7D255383BB543809
                                                                        SHA-512:C3B299F8A021F17315075F82CF94A7914263697343010A164161F5236C3C4F85974B49CB41F74699957659060ABAC7CB3D4DB4505E22B4F04089877F6E44D3A4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE....j`.:.-V.b....G......Y....A.>.3K...SR.M.>.Wp.....h...p..n......N....fE...a{.D.dq...:....5qT...r..dq.....<....ej..w..........E.'dOL&...f....C..U....o`.M...T.U.S...(.r...r.B.e.....0..b.._..Ci.....g.J..W..(..!.l.er.mu..I.b*q.j.(.k<..YZ..}.6..\f.I.!.........m:.x...IBv`...z.. Ut.OF...*j^.d......^m-.znr^..{.P.h...U(....w...S[.]..T..g..............<.~k......&Dm6...%...*u.!.S6W.k.t.~..-{..72.`...l.T...h......d...6a.=....1..v}.j...R.JU{+..]..q~.j...]p.H)...V..&...ka:.....]...p..X.....K0....#.0.N....j...S.r+HC.c.=T.vs]jR\Af....|A?2.w..Z.g...Ij..iv.g..W..S...$=..v#C...c._+........6.5..H...7"....n<.W.....n.....,.B....N.........|..>.d&D.....B...R.....dF.....0.l...(}...5.5..Q...v....^.......~....Z..=..+.....A.b]J6./gS...V...'......qLD6<.......V...-.J...:/..:.2..>,...J..D.zF...S.D..<".U.Zo...yb...^.G...W6.X.....N....<1q!s.....w...D..v._.....Z.f=..6Y..Peh....eg..wC^....5.@..x......E.(...$..q]..{..q9B.....i.~..../..u.&..5A.r.Z2.9.JxJ.jH1b.]..z....

                                                                        C:\Users\user\Documents\IPKGELNTQY\EEGWXUHVUG.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.837560078840078
                                                                        Encrypted:false
                                                                        SSDEEP:24:3pGwbgbQl0E0agujrpGKk4xzsBGO/8sH9aM+Gwm1j9xx0hWbD:3AwbgDFYjrpGYzBkzdaM+XCxxpD
                                                                        MD5:4AEEFB1DC1D4747A43DBD3BFB03E29EE
                                                                        SHA1:8D7EA5EE26943AFFE4F2954A709EA77C29BA5650
                                                                        SHA-256:FEE1CD6620330D776E40EF194AC48852A6F9F54FB068B9F70F36057B37036A37
                                                                        SHA-512:8794DC4B9024092C2BD8DBF67CDB661631ECAC9EE80A1567D4112D81324C5DAD4110986F8DB504D6D9CA606F580846B6774E22119290595D20FBF496189A3B8B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWX~..c....rOH.Y.....!.....z.m..Z.4......5JtG..R+...%..$y.W..F...l4|..ir..1a...Ke{....d...D..*...,b5.X"...|F\..P.\.J.S%a<.$.e...9R...p.....w,....<+Y.-.s..sXR..bYa....5.I8A...Jk.......=....`sa....?.:kG*x.L\7....=.V..p.....c....j.X.'I.C.6..%....9gK9.-!._......s..1..E....M.v$.M.J...QG..}O....!5H..v........}B~S.;.e.S.C..e.r).u...-..z.p..L..l...K.~.mI...r........*.....Ss...RhU3q.dy.G5..:.8.)..J.L.Y...M....M'..-.i..2P...#.Y6..u.{d...!...s.0..I..H......X.,....&..%.Z5......oHq.G.qb.0..%<?.cds.....5.xXg.y..c.W.8?1.B%...:.M. .T.@r.S...d.M..Sk.....;oE.;H,...zc6......... Ik.[diL.C..YBK.H....p..^..>....c.+....B.yE.g......w*..a.~.<.Q} ..1.....x'u.2....#...*...w....E%.}nq.....-r..R7G..0.]..evz.....[.7........3`x'....X.0....)WaQ.l.!O...i...t.k...[./4X/?.]i.....#...._....6...xn....&.m.U.jm.@3.F......E.U.d...].-........k...;..o.y..~...T.sC...w.d[..?<.PHR...c%.l..I..rm..,J;..P;$z98MQ.........l...kTk...uq.R.^.....M...(.:`..,I..~.`E...i...x....C.=.....u.N3

                                                                        C:\Users\user\Documents\IPKGELNTQY\EEGWXUHVUG.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.837560078840078
                                                                        Encrypted:false
                                                                        SSDEEP:24:3pGwbgbQl0E0agujrpGKk4xzsBGO/8sH9aM+Gwm1j9xx0hWbD:3AwbgDFYjrpGYzBkzdaM+XCxxpD
                                                                        MD5:4AEEFB1DC1D4747A43DBD3BFB03E29EE
                                                                        SHA1:8D7EA5EE26943AFFE4F2954A709EA77C29BA5650
                                                                        SHA-256:FEE1CD6620330D776E40EF194AC48852A6F9F54FB068B9F70F36057B37036A37
                                                                        SHA-512:8794DC4B9024092C2BD8DBF67CDB661631ECAC9EE80A1567D4112D81324C5DAD4110986F8DB504D6D9CA606F580846B6774E22119290595D20FBF496189A3B8B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWX~..c....rOH.Y.....!.....z.m..Z.4......5JtG..R+...%..$y.W..F...l4|..ir..1a...Ke{....d...D..*...,b5.X"...|F\..P.\.J.S%a<.$.e...9R...p.....w,....<+Y.-.s..sXR..bYa....5.I8A...Jk.......=....`sa....?.:kG*x.L\7....=.V..p.....c....j.X.'I.C.6..%....9gK9.-!._......s..1..E....M.v$.M.J...QG..}O....!5H..v........}B~S.;.e.S.C..e.r).u...-..z.p..L..l...K.~.mI...r........*.....Ss...RhU3q.dy.G5..:.8.)..J.L.Y...M....M'..-.i..2P...#.Y6..u.{d...!...s.0..I..H......X.,....&..%.Z5......oHq.G.qb.0..%<?.cds.....5.xXg.y..c.W.8?1.B%...:.M. .T.@r.S...d.M..Sk.....;oE.;H,...zc6......... Ik.[diL.C..YBK.H....p..^..>....c.+....B.yE.g......w*..a.~.<.Q} ..1.....x'u.2....#...*...w....E%.}nq.....-r..R7G..0.]..evz.....[.7........3`x'....X.0....)WaQ.l.!O...i...t.k...[./4X/?.]i.....#...._....6...xn....&.m.U.jm.@3.F......E.U.d...].-........k...;..o.y..~...T.sC...w.d[..?<.PHR...c%.l..I..rm..,J;..P;$z98MQ.........l...kTk...uq.R.^.....M...(.:`..,I..~.`E...i...x....C.=.....u.N3

                                                                        C:\Users\user\Documents\IPKGELNTQY\GRXZDKKVDB.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.869438363345635
                                                                        Encrypted:false
                                                                        SSDEEP:24:7gHQEWTUgGIBIaYUW+supqtFnP5I9TMB898HlMqjQ7SzOWbD:cwD3zIJ18InP5+AyIDQ7Sz7D
                                                                        MD5:1DEAE9DA90BC455662924FC51CED7A7C
                                                                        SHA1:4EA208CF6EC0D543E52678F6655294BFBEE60D89
                                                                        SHA-256:C2E0A8756EA66B799866A7F9AF49612426548D30A85797CAD1ECB4D6E6B0F655
                                                                        SHA-512:AD36C64702F94F7843CC28A0E396CF2489D14CE38463538528BC07B51A742FECC97ABDF3514E9F596F6DC9D4785E1A65433E5B346AB92C0C18AC8B5A787D3038
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD...R.....o.#"..c:Q.M..vx5K...x...;..B.....G...o..7E.....{..SJ>..X=..\j...o.Ie............G..s.^.6..3..3h....O.F4.VZ..L.....a.."L...C.d..MY....}...\i.....`...[..p-.F..I..Q...E..g.........)9..k......u.[$J...b...`1.Xb..J..P..cg..G.>.Bs.J.M.o...8......&..3..pJ.K...3.G"...h...P...A.pub.q.$P..cDVa..IZ..|}..'..]7.2VO=..+..Aa+.........\.k..QF.....x.I.,..5...^E...z.%..HN..GX..g.9.{aU.E..gL......&|=..D....{".4.Ayb[...4.....={..H.<f.~0..>~..G....A.xc...V..?.bl=.,?4....Se..-".M....i...O.*rM.......o..._.......v.L..R..2.Y..|....r.....6v.o.*@..3.K......V.r.o.}.5..M..=.>.m........]Z..V.S..u....9;...$a.7.J..Qq..%C.D.....{Im,.N*V.Ff..[`.&..i.N{+M.{_"...N.s.j..yM......[...T.%..H"i.G..?.C.D..g.\.zC..$L3|%....{YW......s.i1.C.....Hd..#w.....;{...Z.V.\7.o1......i..%..u|cG'.q. .RCZ[.Oc....7.........I..U0....:.K..%......[....8...]..(..e\m].~Wdw....9...^up.CW.7..M..k.~.r....>3."?e*..4.].#F..y.\[-4:Q|........E..\F)...1.t....$.A....L..wn.6.....-ta`....rXhs..

                                                                        C:\Users\user\Documents\IPKGELNTQY\GRXZDKKVDB.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.869438363345635
                                                                        Encrypted:false
                                                                        SSDEEP:24:7gHQEWTUgGIBIaYUW+supqtFnP5I9TMB898HlMqjQ7SzOWbD:cwD3zIJ18InP5+AyIDQ7Sz7D
                                                                        MD5:1DEAE9DA90BC455662924FC51CED7A7C
                                                                        SHA1:4EA208CF6EC0D543E52678F6655294BFBEE60D89
                                                                        SHA-256:C2E0A8756EA66B799866A7F9AF49612426548D30A85797CAD1ECB4D6E6B0F655
                                                                        SHA-512:AD36C64702F94F7843CC28A0E396CF2489D14CE38463538528BC07B51A742FECC97ABDF3514E9F596F6DC9D4785E1A65433E5B346AB92C0C18AC8B5A787D3038
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD...R.....o.#"..c:Q.M..vx5K...x...;..B.....G...o..7E.....{..SJ>..X=..\j...o.Ie............G..s.^.6..3..3h....O.F4.VZ..L.....a.."L...C.d..MY....}...\i.....`...[..p-.F..I..Q...E..g.........)9..k......u.[$J...b...`1.Xb..J..P..cg..G.>.Bs.J.M.o...8......&..3..pJ.K...3.G"...h...P...A.pub.q.$P..cDVa..IZ..|}..'..]7.2VO=..+..Aa+.........\.k..QF.....x.I.,..5...^E...z.%..HN..GX..g.9.{aU.E..gL......&|=..D....{".4.Ayb[...4.....={..H.<f.~0..>~..G....A.xc...V..?.bl=.,?4....Se..-".M....i...O.*rM.......o..._.......v.L..R..2.Y..|....r.....6v.o.*@..3.K......V.r.o.}.5..M..=.>.m........]Z..V.S..u....9;...$a.7.J..Qq..%C.D.....{Im,.N*V.Ff..[`.&..i.N{+M.{_"...N.s.j..yM......[...T.%..H"i.G..?.C.D..g.\.zC..$L3|%....{YW......s.i1.C.....Hd..#w.....;{...Z.V.\7.o1......i..%..u|cG'.q. .RCZ[.Oc....7.........I..U0....:.K..%......[....8...]..(..e\m].~Wdw....9...^up.CW.7..M..k.~.r....>3."?e*..4.].#F..y.\[-4:Q|........E..\F)...1.t....$.A....L..wn.6.....-ta`....rXhs..

                                                                        C:\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859417728486038
                                                                        Encrypted:false
                                                                        SSDEEP:24:HGWEXRgVZbnehdZnsMbngRPnKovOCmnLE9MCfwHrKTloDXY2H78Q7WbD:HGWEqZ2nsMbgpvpaY9MCoHeTl84bD
                                                                        MD5:F48F7924235759F0AD8CC8A9A0B1509B
                                                                        SHA1:EFB993B2850636A4E5EEDFEDD0A9DE0F5D2D0390
                                                                        SHA-256:D8E8DD54A31BAC3EA2AD80E5A9AEE8EAA9F0A3011C0C06729A3B3C36DCA96881
                                                                        SHA-512:72D2C1443E242DD9319B4DC5F51FD6DD13C87F4FBE10531BB81E288DD36C453055400E2AAFDCD9A791525D3A6C8ADD5202D462C622A3DB08473992D1A9547DBB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.8..4..YtI=O..`a...k..<..q....0......p.~..c.E....GQ..w.59..... F..m..e...&8{*.B.sv.....:.sW..T.....l..._@.^.4,e7d`T>.%.E..BH...wH..b.u3f.W..r..x.Mw..r.9[...#a\.."Q....'.m..,.}|...V..AZ*0.-=yW...Tn.3l....+..{*...s1.@../y.\...%.OL...R..M.-...`..V..$..)....%......c.-I..^%....i......d.(;Z'..M....(.W}...fBz..*..3.s...nW..$Y.........&..{.r..#..Ml.;.\k....:R...I.7....V..G.w$...-...SS..,3X[gpz.r.Jo....".|..L.....t.E......xy.rg....<(..k.bk..(..<\.......<da\N......WR."..wIT.{.@.jQ...#.@.<......d.z.q*.N.......$)=e.$.$.+q.c...<...@.9.2... ..w..e......WNp.x5i.....3..KV ..r...@....wQ.oG%a..$U..T.H..%..Cm..Nw...Z..3.C...$.2..=.i.z..%..Ii..?.......H,.:j5.G..|..%...o...............}...!.j.....W.u))./.&.m.....q......ajW..n.X...T..-].s.].AP.RZ6.6=..Q@.Pl>.1RB..p..KC..........O..yag..T,I..D..'.D.V"Q...SY.u.m..@.$..K...D ;#...J:.Y..m#..ML~i..=.&k..2~f...<..M..V../..ZN.....hp.9.f.s8........._..z..M.=G#........."&4.,.P.......N..Fh+x.~c\T.v5%...u..S!|;.

                                                                        C:\Users\user\Documents\IPKGELNTQY\IPKGELNTQY.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859417728486038
                                                                        Encrypted:false
                                                                        SSDEEP:24:HGWEXRgVZbnehdZnsMbngRPnKovOCmnLE9MCfwHrKTloDXY2H78Q7WbD:HGWEqZ2nsMbgpvpaY9MCoHeTl84bD
                                                                        MD5:F48F7924235759F0AD8CC8A9A0B1509B
                                                                        SHA1:EFB993B2850636A4E5EEDFEDD0A9DE0F5D2D0390
                                                                        SHA-256:D8E8DD54A31BAC3EA2AD80E5A9AEE8EAA9F0A3011C0C06729A3B3C36DCA96881
                                                                        SHA-512:72D2C1443E242DD9319B4DC5F51FD6DD13C87F4FBE10531BB81E288DD36C453055400E2AAFDCD9A791525D3A6C8ADD5202D462C622A3DB08473992D1A9547DBB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE.8..4..YtI=O..`a...k..<..q....0......p.~..c.E....GQ..w.59..... F..m..e...&8{*.B.sv.....:.sW..T.....l..._@.^.4,e7d`T>.%.E..BH...wH..b.u3f.W..r..x.Mw..r.9[...#a\.."Q....'.m..,.}|...V..AZ*0.-=yW...Tn.3l....+..{*...s1.@../y.\...%.OL...R..M.-...`..V..$..)....%......c.-I..^%....i......d.(;Z'..M....(.W}...fBz..*..3.s...nW..$Y.........&..{.r..#..Ml.;.\k....:R...I.7....V..G.w$...-...SS..,3X[gpz.r.Jo....".|..L.....t.E......xy.rg....<(..k.bk..(..<\.......<da\N......WR."..wIT.{.@.jQ...#.@.<......d.z.q*.N.......$)=e.$.$.+q.c...<...@.9.2... ..w..e......WNp.x5i.....3..KV ..r...@....wQ.oG%a..$U..T.H..%..Cm..Nw...Z..3.C...$.2..=.i.z..%..Ii..?.......H,.:j5.G..|..%...o...............}...!.j.....W.u))./.&.m.....q......ajW..n.X...T..-].s.].AP.RZ6.6=..Q@.Pl>.1RB..p..KC..........O..yag..T,I..D..'.D.V"Q...SY.u.m..@.$..K...D ;#...J:.Y..m#..ML~i..=.&k..2~f...<..M..V../..ZN.....hp.9.f.s8........._..z..M.=G#........."&4.,.P.......N..Fh+x.~c\T.v5%...u..S!|;.

                                                                        C:\Users\user\Documents\IPKGELNTQY\PIVFAGEAAV.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.853723892769303
                                                                        Encrypted:false
                                                                        SSDEEP:24:aEotTmKnAwXrd3/zWxPwK645oN7DrRWlssmBGmtIIfZhZCJ8SqHZvSCjWbD:aEoI7wXh3r0PIN7DFWlss8GHCz8hg1oD
                                                                        MD5:43830197B9E20FC05B6952771902C860
                                                                        SHA1:0846A7B56CF295F92C61040DB39B6146133BE3BE
                                                                        SHA-256:51F304B047580034DA4644971D43A34F0E479F5AA1068B6D191F4B3168681504
                                                                        SHA-512:E1EC0C7706636F7228B6E23ABE1BC2EC18AC1D55D6C3682FCB252636C5A11933D2C4B9A1574A2B62621A56D3364B6282A60F76288EB2EAE8329B614DBEA4EA92
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.>}.6..v.j_....U5..~Y.....y..>....".........R.......,B..$...v0.......w/...g...! ...._}$..0....<.7..*<.q..~.....s..B?.5.U.....T:.....3]].n..(fRC...B(.S.;..P..1....Q..s@...@..W..9.t....9....8.(..sk.2..4..s...x.%D...f....'.....j5..%.........<V.....N.....I.0.W.. ......V....57...........jM.o..G...u..g......%(,........]...."a.....g]..2....D.].......#..nf..._....6=7.....-..d..4d........=..y.DC)......utm.^.Cf.Z..K....D......<.@K:....m_.U?..0..l..R^4{..~x<.c...24&...z...g....}#....%U0...+.*....{.9...5...1.......a..z..........<".B...........u.`.{k...%{On^..G..=..].+.h....tk.W....O..Y.C.b...*....(hd@?.]NT.....8].[6?.}...:..e..k4.R>!.C....8.&..`.....p.!.Z......?...zl1.`.E.....i...]..8.7..J...D~X...M..N......f5!.k.....=..C..:q8D.d.Z..}3...u$2!..>KT....36...L..9.u.(..).........R..z.'.s.....u.B.......E.o^...K..G+..!..x......=......O..l......u...e...r......e..f......0.S..X.. ......P...i..(....T.Abuy7H{o..D.J....<........[.{.9..*W..F..oT

                                                                        C:\Users\user\Documents\IPKGELNTQY\PIVFAGEAAV.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.853723892769303
                                                                        Encrypted:false
                                                                        SSDEEP:24:aEotTmKnAwXrd3/zWxPwK645oN7DrRWlssmBGmtIIfZhZCJ8SqHZvSCjWbD:aEoI7wXh3r0PIN7DFWlss8GHCz8hg1oD
                                                                        MD5:43830197B9E20FC05B6952771902C860
                                                                        SHA1:0846A7B56CF295F92C61040DB39B6146133BE3BE
                                                                        SHA-256:51F304B047580034DA4644971D43A34F0E479F5AA1068B6D191F4B3168681504
                                                                        SHA-512:E1EC0C7706636F7228B6E23ABE1BC2EC18AC1D55D6C3682FCB252636C5A11933D2C4B9A1574A2B62621A56D3364B6282A60F76288EB2EAE8329B614DBEA4EA92
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.>}.6..v.j_....U5..~Y.....y..>....".........R.......,B..$...v0.......w/...g...! ...._}$..0....<.7..*<.q..~.....s..B?.5.U.....T:.....3]].n..(fRC...B(.S.;..P..1....Q..s@...@..W..9.t....9....8.(..sk.2..4..s...x.%D...f....'.....j5..%.........<V.....N.....I.0.W.. ......V....57...........jM.o..G...u..g......%(,........]...."a.....g]..2....D.].......#..nf..._....6=7.....-..d..4d........=..y.DC)......utm.^.Cf.Z..K....D......<.@K:....m_.U?..0..l..R^4{..~x<.c...24&...z...g....}#....%U0...+.*....{.9...5...1.......a..z..........<".B...........u.`.{k...%{On^..G..=..].+.h....tk.W....O..Y.C.b...*....(hd@?.]NT.....8].[6?.}...:..e..k4.R>!.C....8.&..`.....p.!.Z......?...zl1.`.E.....i...]..8.7..J...D~X...M..N......f5!.k.....=..C..:q8D.d.Z..}3...u$2!..>KT....36...L..9.u.(..).........R..z.'.s.....u.B.......E.o^...K..G+..!..x......=......O..l......u...e...r......e..f......0.S..X.. ......P...i..(....T.Abuy7H{o..D.J....<........[.{.9..*W..F..oT

                                                                        C:\Users\user\Documents\IPKGELNTQY\QCFWYSKMHA.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.841989306886088
                                                                        Encrypted:false
                                                                        SSDEEP:24:rxGZG1ps3dut5Z7zWyI6RE6xSpBuCwp/xOcoaWVUcEpNiAVOWbD:rxGZmpsU86REVuCw5snVVORD
                                                                        MD5:2F91FBA717E03AD6C912C0404C71B5FC
                                                                        SHA1:527CAC34C3632344270D8699716834CFF63CCDE2
                                                                        SHA-256:DD182E63AD1003BA2BFD0456169C7F2545151F5D367741A005CFAD7B172A2B66
                                                                        SHA-512:2453BEFEB6B7FD16B639D6D6A97746330F5A2988C947D5D1C305B76AFF971278456EB972104072B470A21D3DF784F04FC17C01B19CB3A058D8CDC741296AA90F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY.i...m.Y.0#...:=..H.......<7m-..\.?.......f......2..c}.S.+7k..80...B.V.Q.......+.C..&......@....%(^bW.....MV^H].,S.b......n.a51$.F.........l..[...T/....R......P N.F.v.:....c._............g.).. ..A.Pe.S...`...<.U.-.n.;>.....:..f.GOD,.oF........L.6.....G..'^.&.....2..(....4.....11)wH..{AR..n+..x..:.-..G..w@5.yUu...."...K>........U.....m.K.t.H...q.=......b....{`(N#..........1i.....#...#pM.tQ..]o.a;[B..-.6....IY.....cJi__@..R...+..Rjf..<..d68q{\..X../..l'.............:!...k.....:$.t....%.<.{zU....:..N.....R...6.+D..5.T...t,r..C........{.*...Q`..@[tBS0..c.,u7#.....h..,.!|G...+.-X.'..X.#.Etg...G....wT.cb...?.f....}`..]Y.d{e4.S.c..X........9.VFh.t.f..c..f.}\7.y.L.Yz.7e.....VM.b.1o2!A6...Vo.R....j.....@5..tF..Ap..;.4I9d.Q)...w~.>.jC%i....C~..)._Hn...avI......rmi:..-FeZ......&g....R..v.#.L.}.G.....=.M<...wy...k.>..}f.....W/..0_y..6W.).n..Y.@.<..d..}<..h.+i..H.lJ.Ak.}.?.w...M/X...@..wr...:...W.%.*....I..LD...u.LK.Y..~N..1.....S....

                                                                        C:\Users\user\Documents\IPKGELNTQY\QCFWYSKMHA.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.841989306886088
                                                                        Encrypted:false
                                                                        SSDEEP:24:rxGZG1ps3dut5Z7zWyI6RE6xSpBuCwp/xOcoaWVUcEpNiAVOWbD:rxGZmpsU86REVuCw5snVVORD
                                                                        MD5:2F91FBA717E03AD6C912C0404C71B5FC
                                                                        SHA1:527CAC34C3632344270D8699716834CFF63CCDE2
                                                                        SHA-256:DD182E63AD1003BA2BFD0456169C7F2545151F5D367741A005CFAD7B172A2B66
                                                                        SHA-512:2453BEFEB6B7FD16B639D6D6A97746330F5A2988C947D5D1C305B76AFF971278456EB972104072B470A21D3DF784F04FC17C01B19CB3A058D8CDC741296AA90F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY.i...m.Y.0#...:=..H.......<7m-..\.?.......f......2..c}.S.+7k..80...B.V.Q.......+.C..&......@....%(^bW.....MV^H].,S.b......n.a51$.F.........l..[...T/....R......P N.F.v.:....c._............g.).. ..A.Pe.S...`...<.U.-.n.;>.....:..f.GOD,.oF........L.6.....G..'^.&.....2..(....4.....11)wH..{AR..n+..x..:.-..G..w@5.yUu...."...K>........U.....m.K.t.H...q.=......b....{`(N#..........1i.....#...#pM.tQ..]o.a;[B..-.6....IY.....cJi__@..R...+..Rjf..<..d68q{\..X../..l'.............:!...k.....:$.t....%.<.{zU....:..N.....R...6.+D..5.T...t,r..C........{.*...Q`..@[tBS0..c.,u7#.....h..,.!|G...+.-X.'..X.#.Etg...G....wT.cb...?.f....}`..]Y.d{e4.S.c..X........9.VFh.t.f..c..f.}\7.y.L.Yz.7e.....VM.b.1o2!A6...Vo.R....j.....@5..tF..Ap..;.4I9d.Q)...w~.>.jC%i....C~..)._Hn...avI......rmi:..-FeZ......&g....R..v.#.L.}.G.....=.M<...wy...k.>..}f.....W/..0_y..6W.).n..Y.@.<..d..}<..h.+i..H.lJ.Ak.}.?.w...M/X...@..wr...:...W.%.*....I..LD...u.LK.Y..~N..1.....S....

                                                                        C:\Users\user\Documents\IPKGELNTQY\ZQIXMVQGAH.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.869514756382804
                                                                        Encrypted:false
                                                                        SSDEEP:24:HI8kQk6ZMZLktngGGOgfP87ZEbicO8/kDZT2wGxJWbD:HI8g6ZjXwFG74kDZTXD
                                                                        MD5:1346E6B911236805D7E42C5BBA187C65
                                                                        SHA1:55D2EBE0009C7875603A197657B7549156255D09
                                                                        SHA-256:66186B0999C987C36BBCCD99A1DE237F1BE354BB5B6A37A1B6BA94DC6A9026DF
                                                                        SHA-512:8E85F2BC14E71C9C60CCB54632B6011A86C7D13CB73665151F8B14CA55D86C978F1E79EE9422DB0CD19E4312A823F1459F098FECCAC7876E60A0FA57CE7FD851
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.........r3&..C..M....J.I.)...Nl......_\.Dt9.L......V .....R..i.....$..g.}...&.Xq...Rx..`.da..F_..>{..F$....Nz].... Q>u.\..*.D...M.....<...).3..1.\.W....X\..}"......H}..v.+...-U....RJ.1....U-!W+.v...!q...Z.J..zo...MY(.p.......\.QT.`.2(/.3..0...X..H......ZhWk.T.r.... ..;.M.n>.[.K.=>.V..........6i@A,....$.83...:.j.f.S.zw.... 5..]..`[|y.....R.)..@......X(....A.2np..KFF.Y..*..%..d... ....F".. .*m..%io..........J;uJ.85d.s.d......!.....?.{...W..L.\4.R..n...;U...w..x...&......R%...W....f.Cs.ueR..K.q.[..)..3Q.....,...f9......5/.h.nh.w...uq....[X...q...._.h.@.....h.7..!.T.. .d..."..oc...:..F..d...~>C......5.W...|c.NQ......A..t.$..qj..^E.FA5.q..)%@.=2.........%...2.W.i.k.&a......}..CC.z.QI.t..s1.l%..Q.....&.....p.7=.?....e7....'>F8h....;.E..|U.qRo.....*8..a.\.....;..38..G...m....._..u...B...........a=..5P{..&..n<...$......SY..|#:k..~..{.a.D{..V..0.=fP.w.@..E.N.(.....<.$....S........C.b.l...K...w...5d..k...qf$d.....c........z.'...f..j.y1\..%.$.o.B.

                                                                        C:\Users\user\Documents\IPKGELNTQY\ZQIXMVQGAH.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.869514756382804
                                                                        Encrypted:false
                                                                        SSDEEP:24:HI8kQk6ZMZLktngGGOgfP87ZEbicO8/kDZT2wGxJWbD:HI8g6ZjXwFG74kDZTXD
                                                                        MD5:1346E6B911236805D7E42C5BBA187C65
                                                                        SHA1:55D2EBE0009C7875603A197657B7549156255D09
                                                                        SHA-256:66186B0999C987C36BBCCD99A1DE237F1BE354BB5B6A37A1B6BA94DC6A9026DF
                                                                        SHA-512:8E85F2BC14E71C9C60CCB54632B6011A86C7D13CB73665151F8B14CA55D86C978F1E79EE9422DB0CD19E4312A823F1459F098FECCAC7876E60A0FA57CE7FD851
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.........r3&..C..M....J.I.)...Nl......_\.Dt9.L......V .....R..i.....$..g.}...&.Xq...Rx..`.da..F_..>{..F$....Nz].... Q>u.\..*.D...M.....<...).3..1.\.W....X\..}"......H}..v.+...-U....RJ.1....U-!W+.v...!q...Z.J..zo...MY(.p.......\.QT.`.2(/.3..0...X..H......ZhWk.T.r.... ..;.M.n>.[.K.=>.V..........6i@A,....$.83...:.j.f.S.zw.... 5..]..`[|y.....R.)..@......X(....A.2np..KFF.Y..*..%..d... ....F".. .*m..%io..........J;uJ.85d.s.d......!.....?.{...W..L.\4.R..n...;U...w..x...&......R%...W....f.Cs.ueR..K.q.[..)..3Q.....,...f9......5/.h.nh.w...uq....[X...q...._.h.@.....h.7..!.T.. .d..."..oc...:..F..d...~>C......5.W...|c.NQ......A..t.$..qj..^E.FA5.q..)%@.=2.........%...2.W.i.k.&a......}..CC.z.QI.t..s1.l%..Q.....&.....p.7=.?....e7....'>F8h....;.E..|U.qRo.....*8..a.\.....;..38..G...m....._..u...B...........a=..5P{..&..n<...$......SY..|#:k..~..{.a.D{..V..0.=fP.w.@..E.N.(.....<.$....S........C.b.l...K...w...5d..k...qf$d.....c........z.'...f..j.y1\..%.$.o.B.

                                                                        C:\Users\user\Documents\LSBIHQFDVT.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860105090123233
                                                                        Encrypted:false
                                                                        SSDEEP:24:Kh+y3ARHTigRxe+5MdsUK+4+qpa9R74C6S1V21X9luHiCiLXYI/ExWbD:Kh+1pRo+O6UKl+n74Cd141X9gCCiLX9D
                                                                        MD5:20CCB1922C9A0F3BAE334708B355CCFE
                                                                        SHA1:5AD21A0903031AEF22B5B61DCD99EA5C45C78D72
                                                                        SHA-256:62CA574D1479ECDD03A612E1309C3CAC8988DC267A1E4340ECF5AEAEFA183993
                                                                        SHA-512:DA68964EA5A637E58CCB783C29FB3720B6D5B576BD0B3B0D9CF5C8C50F0ED6876F845BD200D0ED6376D6F921CF20EE8AC5FF294C513822E2582DE55AC78E0DAC
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIH.O.....uj..h.5..Sj<w..6se.....P......H..U.7....H...~./..Hr7.%.c.(z.MU.......ft.....=.K.ke).=...:..~$.!..4*_...y.j.@$..l,x[..yY......M}Y..a)v.k......2s.....6.E9....Z..9..,Zu...h.....&j...L.....n.)%.A.....7......R.a]0....I9....y...4.D..;....uw/R....+37...a.Fi..[..# ..N..^..M.. ._...x...c..Wf.`.G,..m...Db.0.h..j...F.1..X=..:...;...c...e."..^....S.|...+.q.n..L.D..A.m.. .?.d...=K8&*...`>.w..h#..:.y..=2^..........>..32^\.O...T......-..Y..#.6?.6...W]....U.!#pA..i.%........3.....&.[...Y...l....a.....].0Y~..C...'(i.9.`?t.,.6......Q...qZ..3..z.....='.9%%,....W...]...{+...A......{.....S..I....Gp...o....L..P.<.P.,..]^....OU..m..m..o"X.3B.{..T.v-....C..].mA......t.E`.'>....m.1?B.Di. .|">..'....-.e.9.&,:8.....2..~2(|.....t...~..C.O.&t.}$.|.O-..c..4.._....Q.w.c.".{Due..^.*..........".T0`..9q.^.....{x4og....g......0l}.....t.B......X...(+..].>=.9...<3..p..o-.....?e....k.=.Q.. ....ZG..A......H*n9g.\l".,...j....t....V.......4.93........b8J-.

                                                                        C:\Users\user\Documents\LSBIHQFDVT.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860105090123233
                                                                        Encrypted:false
                                                                        SSDEEP:24:Kh+y3ARHTigRxe+5MdsUK+4+qpa9R74C6S1V21X9luHiCiLXYI/ExWbD:Kh+1pRo+O6UKl+n74Cd141X9gCCiLX9D
                                                                        MD5:20CCB1922C9A0F3BAE334708B355CCFE
                                                                        SHA1:5AD21A0903031AEF22B5B61DCD99EA5C45C78D72
                                                                        SHA-256:62CA574D1479ECDD03A612E1309C3CAC8988DC267A1E4340ECF5AEAEFA183993
                                                                        SHA-512:DA68964EA5A637E58CCB783C29FB3720B6D5B576BD0B3B0D9CF5C8C50F0ED6876F845BD200D0ED6376D6F921CF20EE8AC5FF294C513822E2582DE55AC78E0DAC
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIH.O.....uj..h.5..Sj<w..6se.....P......H..U.7....H...~./..Hr7.%.c.(z.MU.......ft.....=.K.ke).=...:..~$.!..4*_...y.j.@$..l,x[..yY......M}Y..a)v.k......2s.....6.E9....Z..9..,Zu...h.....&j...L.....n.)%.A.....7......R.a]0....I9....y...4.D..;....uw/R....+37...a.Fi..[..# ..N..^..M.. ._...x...c..Wf.`.G,..m...Db.0.h..j...F.1..X=..:...;...c...e."..^....S.|...+.q.n..L.D..A.m.. .?.d...=K8&*...`>.w..h#..:.y..=2^..........>..32^\.O...T......-..Y..#.6?.6...W]....U.!#pA..i.%........3.....&.[...Y...l....a.....].0Y~..C...'(i.9.`?t.,.6......Q...qZ..3..z.....='.9%%,....W...]...{+...A......{.....S..I....Gp...o....L..P.<.P.,..]^....OU..m..m..o"X.3B.{..T.v-....C..].mA......t.E`.'>....m.1?B.Di. .|">..'....-.e.9.&,:8.....2..~2(|.....t...~..C.O.&t.}$.|.O-..c..4.._....Q.w.c.".{Due..^.*..........".T0`..9q.^.....{x4og....g......0l}.....t.B......X...(+..].>=.9...<3..p..o-.....?e....k.=.Q.. ....ZG..A......H*n9g.\l".,...j....t....V.......4.93........b8J-.

                                                                        C:\Users\user\Documents\MXPXCVPDVN.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.857548975744538
                                                                        Encrypted:false
                                                                        SSDEEP:24:vMjWAsVbFq1qIhcmcedtES6SY2uaLBGGNlxk+0e3BWlfw2UWco/1QHTh9w+YKGgQ:v8WnF2qIhcmcMCSsqLFNlxRgbZ/1oh9Y
                                                                        MD5:71B75B8683A62336B16954EE998128C5
                                                                        SHA1:C86D59DED7E67A140EFD5D341838E385D5A4B7B5
                                                                        SHA-256:B89CD93B6E18FB45D5AB267DE3B22F152B37773BFDEE17DA5DA78978919EFA18
                                                                        SHA-512:75E5D1A580C99509FAB45902A437073FE13F1F237B510BA66E18E22748C633923DC5A65813171204A150CDDE6CDD9C2760F43FB34492916E6A1065F5B53CB1FE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC.d"..Mw.]Li...5q....A....WG..z.}..(.>..7.5.....6A..h.]......%.u(,.z .R..|.@...'..uc0P^v...8.u..v...#.[.4.Z..qn*.:.Fj\ f....T..?7.Ti.j.?.}......}Y6.V.P.(.. ..M*..3../..mb.......yC.|......\1..........U.......}.K...*.q`.MR.&...s..|...p..}......6.@.......N...........}.....1.2..l..$.s......av...`.b.....oxF....U...$"..<A....A>...!~..<Ba..v5'......f)....<...g......#...UJ....4..x.s..+.Vh..7..K...........WU).......y ...e.&;..1....c...>Y..I..bz...1...PMN..H..Kg.&.(.H....'...Z.Y.....,%..H.\...Ml....#q..L.P...P...I,..2.g.2W..^=...d...v...... Z..0."./..e2.FN{....o.Q.S.f.j...JBS......B.].LG....?.2}8..z>GPp.L..L...~..(...6.....D.U<n.....J.^......G(...L..y...ka....&.!.(.o.h...t..M....x.v^...+.z.n~Np...:!'].d...s`..}j..}...{.JJZ<..Oy......8...<....(...V.f#..4.T.y\.M.b.......N.}f.M.I.......92|.<.0..3.%...[NR..]....,..5..$..gwN3..#...'o..4Y:.\sZ..9....(..n......(..2....|...,.}G.V...-d........Y.....kf....-HW......Q.~.mn..}..<.n}......-.....<...,.m8Z....R

                                                                        C:\Users\user\Documents\MXPXCVPDVN.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.857548975744538
                                                                        Encrypted:false
                                                                        SSDEEP:24:vMjWAsVbFq1qIhcmcedtES6SY2uaLBGGNlxk+0e3BWlfw2UWco/1QHTh9w+YKGgQ:v8WnF2qIhcmcMCSsqLFNlxRgbZ/1oh9Y
                                                                        MD5:71B75B8683A62336B16954EE998128C5
                                                                        SHA1:C86D59DED7E67A140EFD5D341838E385D5A4B7B5
                                                                        SHA-256:B89CD93B6E18FB45D5AB267DE3B22F152B37773BFDEE17DA5DA78978919EFA18
                                                                        SHA-512:75E5D1A580C99509FAB45902A437073FE13F1F237B510BA66E18E22748C633923DC5A65813171204A150CDDE6CDD9C2760F43FB34492916E6A1065F5B53CB1FE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC.d"..Mw.]Li...5q....A....WG..z.}..(.>..7.5.....6A..h.]......%.u(,.z .R..|.@...'..uc0P^v...8.u..v...#.[.4.Z..qn*.:.Fj\ f....T..?7.Ti.j.?.}......}Y6.V.P.(.. ..M*..3../..mb.......yC.|......\1..........U.......}.K...*.q`.MR.&...s..|...p..}......6.@.......N...........}.....1.2..l..$.s......av...`.b.....oxF....U...$"..<A....A>...!~..<Ba..v5'......f)....<...g......#...UJ....4..x.s..+.Vh..7..K...........WU).......y ...e.&;..1....c...>Y..I..bz...1...PMN..H..Kg.&.(.H....'...Z.Y.....,%..H.\...Ml....#q..L.P...P...I,..2.g.2W..^=...d...v...... Z..0."./..e2.FN{....o.Q.S.f.j...JBS......B.].LG....?.2}8..z>GPp.L..L...~..(...6.....D.U<n.....J.^......G(...L..y...ka....&.!.(.o.h...t..M....x.v^...+.z.n~Np...:!'].d...s`..}j..}...{.JJZ<..Oy......8...<....(...V.f#..4.T.y\.M.b.......N.}f.M.I.......92|.<.0..3.%...[NR..]....,..5..$..gwN3..#...'o..4Y:.\sZ..9....(..n......(..2....|...,.}G.V...-d........Y.....kf....-HW......Q.~.mn..}..<.n}......-.....<...,.m8Z....R

                                                                        C:\Users\user\Documents\MXPXCVPDVN\IPKGELNTQY.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.833857511500328
                                                                        Encrypted:false
                                                                        SSDEEP:24:EZf5TySudjx3H8p9tSSqi0dJByluBX/jI3xLC2XxTGi8T/RpWbD:oTySudjx3cUSW0kbSRGis/R2D
                                                                        MD5:C4053E6700870CAA6A19A2F0C5B382B4
                                                                        SHA1:20CB68F737BEE7511C0BB3283533DA922B9190A5
                                                                        SHA-256:00CA936F16F8BA1874DA8855CAAF72E64BA99C9F4302A321200573E58EBFCF1D
                                                                        SHA-512:CBE4DA70375D63A4D2EAC8CAC5677A3D0CE74C187E68FD66304008169B91E322F146B65F78E870FEE8DFFC5BE59D8A777AB41DCF3C7DC1D8D3A4DD6E422E60D1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE........W8LtJ..jb....1...u..,}#...{..i]o..g... L.........&g..S7..V.C..t_.|f..Uz.9.F.(.i'.....Oz.R?.nj....Z$..W.DSo.2.....hc.[:..m..%P...BV62AC+L...........W?..nq....4f7....9.....^<sk.0...<.'gb...{.....9|1bp7.S5.`..L .L.sqZ..2........IQ!.../.=.'.-.@o..[x...K$..K".L..]...s..........^...VG./.x..f..e...GG......J.w..$L.X..(...Lb.G.pf...g.@..rv.A..x-'...X.".Bp.d..b..]^......R8.....Q..6-...p.........[~.#................".....-.OP.......C.p\...'....K..N.q!.u...@.Ia.{|...2..B.b...).B....L.|.\.L."v6...N5...+?...lq/..!.<...... .5.m..GS.....?..b.|...j....i..>.....`#.........d...~...m..P....aq7.n/]..o#z..G,.%/0.Z.Nj......{][b..U.k$i........&..J.e.i15.O.'..S..`.u[.........*6....I..H=..G.*nj.tr."..^...Y..VF...............^.v\...7.~U...u.H....h..u..hK...j..I7%.u.(^i........|E..e..`MrU*!Q...S.O...........Va..Ne......0O...`.. j.&.`.......$...I...B.-.t\...a'sk%.G..sO.yW.Q...>..4.tG.^...?......0v.>. Zo...t-.P3...J..h|v`.$...&E.H.B..s1X.N...

                                                                        C:\Users\user\Documents\MXPXCVPDVN\IPKGELNTQY.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.833857511500328
                                                                        Encrypted:false
                                                                        SSDEEP:24:EZf5TySudjx3H8p9tSSqi0dJByluBX/jI3xLC2XxTGi8T/RpWbD:oTySudjx3cUSW0kbSRGis/R2D
                                                                        MD5:C4053E6700870CAA6A19A2F0C5B382B4
                                                                        SHA1:20CB68F737BEE7511C0BB3283533DA922B9190A5
                                                                        SHA-256:00CA936F16F8BA1874DA8855CAAF72E64BA99C9F4302A321200573E58EBFCF1D
                                                                        SHA-512:CBE4DA70375D63A4D2EAC8CAC5677A3D0CE74C187E68FD66304008169B91E322F146B65F78E870FEE8DFFC5BE59D8A777AB41DCF3C7DC1D8D3A4DD6E422E60D1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE........W8LtJ..jb....1...u..,}#...{..i]o..g... L.........&g..S7..V.C..t_.|f..Uz.9.F.(.i'.....Oz.R?.nj....Z$..W.DSo.2.....hc.[:..m..%P...BV62AC+L...........W?..nq....4f7....9.....^<sk.0...<.'gb...{.....9|1bp7.S5.`..L .L.sqZ..2........IQ!.../.=.'.-.@o..[x...K$..K".L..]...s..........^...VG./.x..f..e...GG......J.w..$L.X..(...Lb.G.pf...g.@..rv.A..x-'...X.".Bp.d..b..]^......R8.....Q..6-...p.........[~.#................".....-.OP.......C.p\...'....K..N.q!.u...@.Ia.{|...2..B.b...).B....L.|.\.L."v6...N5...+?...lq/..!.<...... .5.m..GS.....?..b.|...j....i..>.....`#.........d...~...m..P....aq7.n/]..o#z..G,.%/0.Z.Nj......{][b..U.k$i........&..J.e.i15.O.'..S..`.u[.........*6....I..H=..G.*nj.tr."..^...Y..VF...............^.v\...7.~U...u.H....h..u..hK...j..I7%.u.(^i........|E..e..`MrU*!Q...S.O...........Va..Ne......0O...`.. j.&.`.......$...I...B.-.t\...a'sk%.G..sO.yW.Q...>..4.tG.^...?......0v.>. Zo...t-.P3...J..h|v`.$...&E.H.B..s1X.N...

                                                                        C:\Users\user\Documents\MXPXCVPDVN\LSBIHQFDVT.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865539436192821
                                                                        Encrypted:false
                                                                        SSDEEP:24:KB7hmny9Ly6akHYLdwEZKb9IBk3qTxNZu5qrSiwA2lS7aYpD//wL7Vk6Gn+hswnQ:KDmnC7akHmA5Ix65G2lS7THOaX+hswED
                                                                        MD5:22BC5712BCCE7B5C6DC53FC068E3CF53
                                                                        SHA1:C7F6536D09B0FAB74A4489066AF1D6DC7407C76E
                                                                        SHA-256:4EB5B76D8B7CB112D53F198772C2E7CBFD6C495978726ED4BDFF85C14ECE7C07
                                                                        SHA-512:2F11C24820E21FF5C9BC7EA3828056184938C4A100D0E9A20A2627D2AA2357883B0066F65EFABF05E1F78649A364F12A83846836837DEAA2C5EC8B64618E263E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIHz..,9...Q>.W.mvl.>..L.....T.N.f.O..q.ar.......|.?.LC...IC..XwG.....2ng..)X/.m.......P.:5!...CT7..L}.k.?P..(.v..z"j..)..*...1E....N.3...G.g.D..1.-.q..35S.....3..]....].. .-&..(.c...e.b....?....~...T)Hs.....L.U..su.3.Cn..q?...DU...n...k[*..O...&..'<.n[.;.^5;...}.f].mH-x. .@.1G<.7'...}m.w.T3....~...DU1.$(..."'.+.-..\.G!........IM....}..B|...:.......rij.4Y%B............\...0.E.."e.6#...T.y".>..Z.x.;......Y|....u.?.e.#..+.jr..J.2Y.p..i.#I^.........].I.,.2.1E].nU...A....!3....Y.9......,. ...JI...`...,...6.a.xK....];.W.Y.5..y....f.L.q.s...io...S-..?V:.`Yh....a.,......RD,.........G..Nq..!..#...R............p.C....b~@a'.Mm.O..q..T..j!L../%-G. [$b...4u...fPylK?..z....5........A)$..)u.!.>..:...chz...R1....4..;..T...>........3.cV.v...#....#V....w&1-.;3...+c....8..~.*.....=Z..3H.p..D..,w.ae..r.....C..[.......|...Q/......Z.>....@.=kO.Ol...r.t.....>....=..l.P[ <..).!d.&?ud....n.i.a....cQ.M...ZtI.....9.kG{.V..L.*N*..D.<.;._,#..~eY.R.

                                                                        C:\Users\user\Documents\MXPXCVPDVN\LSBIHQFDVT.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865539436192821
                                                                        Encrypted:false
                                                                        SSDEEP:24:KB7hmny9Ly6akHYLdwEZKb9IBk3qTxNZu5qrSiwA2lS7aYpD//wL7Vk6Gn+hswnQ:KDmnC7akHmA5Ix65G2lS7THOaX+hswED
                                                                        MD5:22BC5712BCCE7B5C6DC53FC068E3CF53
                                                                        SHA1:C7F6536D09B0FAB74A4489066AF1D6DC7407C76E
                                                                        SHA-256:4EB5B76D8B7CB112D53F198772C2E7CBFD6C495978726ED4BDFF85C14ECE7C07
                                                                        SHA-512:2F11C24820E21FF5C9BC7EA3828056184938C4A100D0E9A20A2627D2AA2357883B0066F65EFABF05E1F78649A364F12A83846836837DEAA2C5EC8B64618E263E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIHz..,9...Q>.W.mvl.>..L.....T.N.f.O..q.ar.......|.?.LC...IC..XwG.....2ng..)X/.m.......P.:5!...CT7..L}.k.?P..(.v..z"j..)..*...1E....N.3...G.g.D..1.-.q..35S.....3..]....].. .-&..(.c...e.b....?....~...T)Hs.....L.U..su.3.Cn..q?...DU...n...k[*..O...&..'<.n[.;.^5;...}.f].mH-x. .@.1G<.7'...}m.w.T3....~...DU1.$(..."'.+.-..\.G!........IM....}..B|...:.......rij.4Y%B............\...0.E.."e.6#...T.y".>..Z.x.;......Y|....u.?.e.#..+.jr..J.2Y.p..i.#I^.........].I.,.2.1E].nU...A....!3....Y.9......,. ...JI...`...,...6.a.xK....];.W.Y.5..y....f.L.q.s...io...S-..?V:.`Yh....a.,......RD,.........G..Nq..!..#...R............p.C....b~@a'.Mm.O..q..T..j!L../%-G. [$b...4u...fPylK?..z....5........A)$..)u.!.>..:...chz...R1....4..;..T...>........3.cV.v...#....#V....w&1-.;3...+c....8..~.*.....=Z..3H.p..D..,w.ae..r.....C..[.......|...Q/......Z.>....@.=kO.Ol...r.t.....>....=..l.P[ <..).!d.&?ud....n.i.a....cQ.M...ZtI.....9.kG{.V..L.*N*..D.<.;._,#..~eY.R.

                                                                        C:\Users\user\Documents\MXPXCVPDVN\MXPXCVPDVN.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860934804331394
                                                                        Encrypted:false
                                                                        SSDEEP:24:yEU8buoxTvf4LTTb4Da/PYyH/zFHUBeKtIW4xdr1RnsV7IM2sGw+DtNWPWbD:y8bddvf4LHEOLJU94x51R27IM2/tDtDD
                                                                        MD5:0D7F4CACE473DF589F04B8DEE389C193
                                                                        SHA1:71FE99C8B2188632EF8713A6B69E4E6340D3B8C2
                                                                        SHA-256:809AFCEF39612138D76D4D7781411AB309AC78D2E300EB188899CBFE94D74496
                                                                        SHA-512:4328F52B347B63077D955F8D070A2FA375865CDF61CFE0FD9A1A527F25F80D587B4EFE4F7B2F2CB3016600BB9783096D065F8769A87B849F1DC47A8DA3190C9D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC3.L?L....9.....--.....p.I...!{E<...71).P.T:.}N.{u.B.X...H..4.=...q....$.nX...{.>f........k.:$.&Q.e...^`.......@.j.......At....;......^.9.......mTU#}Rcs...mA.@_...~w.......9t.|~..>..Y.w.......).....b.To.....z#j1?).\t...q.m..H.L..6...a.\U....._..k \...lm..i..e$..^..{-.....x....T./.....z..'.X.u..g. ...Ou0.]x....1.....<..9.rJ.b.+,.....\..)..M2...CpXn....F.C\!}.u.r=..ASy..L..P.r{!.+.C.o.+=.4.w......./. ...a@.4>O.{Rnd;5.....=m.c.gz.....T`u~.t.s?..%m. ....pK.M.8.~.4.0...6c.....R.=.a....AT.e..i.."xv2..q.o,.....A..m..f...QUA.|.<r..#._.]}.H.}..........N....Dk\.n#<.......a...9.z...|..A.....~o.......8I...c1K"....L...l...~....!.4..e/...)..s..*|...R.Da!;..S......a..WMxp..x>].....il.~Q.@..$"*C ..L.K'iA?...U........j.n..&.....(...I....a;.zR...GR..3......kR..@J..t..(L`.~..C..r...[...Q..4t..c%....s...9..n7..>.......D....o.d_.r>...^..5r..ND.?:`.I6~.d...|...mN......f..ma.......%Q./......]5)*.y../L...?.C...)V.|.@5.O2...8'1.../.z.\...G..IB..C..E8.+h

                                                                        C:\Users\user\Documents\MXPXCVPDVN\MXPXCVPDVN.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.860934804331394
                                                                        Encrypted:false
                                                                        SSDEEP:24:yEU8buoxTvf4LTTb4Da/PYyH/zFHUBeKtIW4xdr1RnsV7IM2sGw+DtNWPWbD:y8bddvf4LHEOLJU94x51R27IM2/tDtDD
                                                                        MD5:0D7F4CACE473DF589F04B8DEE389C193
                                                                        SHA1:71FE99C8B2188632EF8713A6B69E4E6340D3B8C2
                                                                        SHA-256:809AFCEF39612138D76D4D7781411AB309AC78D2E300EB188899CBFE94D74496
                                                                        SHA-512:4328F52B347B63077D955F8D070A2FA375865CDF61CFE0FD9A1A527F25F80D587B4EFE4F7B2F2CB3016600BB9783096D065F8769A87B849F1DC47A8DA3190C9D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC3.L?L....9.....--.....p.I...!{E<...71).P.T:.}N.{u.B.X...H..4.=...q....$.nX...{.>f........k.:$.&Q.e...^`.......@.j.......At....;......^.9.......mTU#}Rcs...mA.@_...~w.......9t.|~..>..Y.w.......).....b.To.....z#j1?).\t...q.m..H.L..6...a.\U....._..k \...lm..i..e$..^..{-.....x....T./.....z..'.X.u..g. ...Ou0.]x....1.....<..9.rJ.b.+,.....\..)..M2...CpXn....F.C\!}.u.r=..ASy..L..P.r{!.+.C.o.+=.4.w......./. ...a@.4>O.{Rnd;5.....=m.c.gz.....T`u~.t.s?..%m. ....pK.M.8.~.4.0...6c.....R.=.a....AT.e..i.."xv2..q.o,.....A..m..f...QUA.|.<r..#._.]}.H.}..........N....Dk\.n#<.......a...9.z...|..A.....~o.......8I...c1K"....L...l...~....!.4..e/...)..s..*|...R.Da!;..S......a..WMxp..x>].....il.~Q.@..$"*C ..L.K'iA?...U........j.n..&.....(...I....a;.zR...GR..3......kR..@J..t..(L`.~..C..r...[...Q..4t..c%....s...9..n7..>.......D....o.d_.r>...^..5r..ND.?:`.I6~.d...|...mN......f..ma.......%Q./......]5)*.y../L...?.C...)V.|.@5.O2...8'1.../.z.\...G..IB..C..E8.+h

                                                                        C:\Users\user\Documents\MXPXCVPDVN\NEBFQQYWPS.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8579770723175955
                                                                        Encrypted:false
                                                                        SSDEEP:24:uuHp67ZFTS0LuZBOgm20hzNQcfcJv1XPdATFhCbuWtahGNBe6PpnVSJtCWbD:jHQTuPOg50hBTwhPmRYbuWsgNkaOD
                                                                        MD5:5AED088AFB4A15B520566835B9D6773C
                                                                        SHA1:3ABFAE92D15CE34D8F0139252CE09B5EE5B059A3
                                                                        SHA-256:FB65707B6A030C01C6420B1962FDB0DC2D0000C138BA6E5BB9565C7DDF6C5433
                                                                        SHA-512:B8F84BFB78B8B92BE7699F8FE1AB9544ED455FF0744E396446CA5D4D78119FBE20396407715FA4014F7CDE64BA7A06A47AE2C0244247CCD68C80F3C4B33384A9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQQ...ND........!..$.e.5..5...M9........!...,x...|....H.,..|......p'..__..l..........%.j.!..2......W...!/...xn..9.0<....K.c...M>...y.VE..W..z..e/:..4...0...]._(#....Hg..H...I'.Tx...v.^{~..Xs..i...........F.B..&j..oid.F.!?a..95..'.+..wI]...#.9.........+...7.4..-.+#..".j....s..<......9.@R.Xf.....^_~.....0..o.......3..N..#..../q..h....`.+?..H^..$..cl..%....*.2o.9..$h.&.5q..S.R.sF....kej...7...b.nObb...`j....%.~..].+............D.g...0{3.3).{...-.mA..LT::...?!...*.....G....V....Y..2I3#.@&....l........Y.(....n..F|.#9..i....~\r..d..?.eWF.n$.p....u..g7...aafxI..@..Fc,../..LN#....m.....g.GE. ......*.3l`.vL..@..,*|.....Ol.(.G....p.=.+.-j.....A............Z...=+..z.{..:.]|!.......w-.c..Y...$g_...F.tI|S..7...........;...#.y..".w_.f........._..@.jy..6(|.z....G..g^....M].R.G...4.Yn..*.|.r....G...\..7..Z./.^..udf*>...P...p.{1.n....OKE...i2..B...2........Ecr....TF..F.%..@1.F...V{..B...d0.PR...~....AU.C..{...Q....,9J...(W;.#.r2. ..D.0.....1..

                                                                        C:\Users\user\Documents\MXPXCVPDVN\NEBFQQYWPS.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8579770723175955
                                                                        Encrypted:false
                                                                        SSDEEP:24:uuHp67ZFTS0LuZBOgm20hzNQcfcJv1XPdATFhCbuWtahGNBe6PpnVSJtCWbD:jHQTuPOg50hBTwhPmRYbuWsgNkaOD
                                                                        MD5:5AED088AFB4A15B520566835B9D6773C
                                                                        SHA1:3ABFAE92D15CE34D8F0139252CE09B5EE5B059A3
                                                                        SHA-256:FB65707B6A030C01C6420B1962FDB0DC2D0000C138BA6E5BB9565C7DDF6C5433
                                                                        SHA-512:B8F84BFB78B8B92BE7699F8FE1AB9544ED455FF0744E396446CA5D4D78119FBE20396407715FA4014F7CDE64BA7A06A47AE2C0244247CCD68C80F3C4B33384A9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQQ...ND........!..$.e.5..5...M9........!...,x...|....H.,..|......p'..__..l..........%.j.!..2......W...!/...xn..9.0<....K.c...M>...y.VE..W..z..e/:..4...0...]._(#....Hg..H...I'.Tx...v.^{~..Xs..i...........F.B..&j..oid.F.!?a..95..'.+..wI]...#.9.........+...7.4..-.+#..".j....s..<......9.@R.Xf.....^_~.....0..o.......3..N..#..../q..h....`.+?..H^..$..cl..%....*.2o.9..$h.&.5q..S.R.sF....kej...7...b.nObb...`j....%.~..].+............D.g...0{3.3).{...-.mA..LT::...?!...*.....G....V....Y..2I3#.@&....l........Y.(....n..F|.#9..i....~\r..d..?.eWF.n$.p....u..g7...aafxI..@..Fc,../..LN#....m.....g.GE. ......*.3l`.vL..@..,*|.....Ol.(.G....p.=.+.-j.....A............Z...=+..z.{..:.]|!.......w-.c..Y...$g_...F.tI|S..7...........;...#.y..".w_.f........._..@.jy..6(|.z....G..g^....M].R.G...4.Yn..*.|.r....G...\..7..Z./.^..udf*>...P...p.{1.n....OKE...i2..B...2........Ecr....TF..F.%..@1.F...V{..B...d0.PR...~....AU.C..{...Q....,9J...(W;.#.r2. ..D.0.....1..

                                                                        C:\Users\user\Documents\MXPXCVPDVN\SFPUSAFIOL.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867900285910913
                                                                        Encrypted:false
                                                                        SSDEEP:24:NnFhZAbdhsBIaw/YvygIi4Mf7RWaUJ3S8RVldq4FT3ZDw+zWbD:NvydhsBIsK6FUnVVFjdw+wD
                                                                        MD5:3035346185E58961CD848E92B4CEE74C
                                                                        SHA1:FAB3ACE462E8ED3730BFF19C2DE87F87F529ADCA
                                                                        SHA-256:BE64F963DFF7EE8639D4F50365660576D489FBC67A8EA1A670F181BD9D131B70
                                                                        SHA-512:439E05A54AF41603E0E5FC972913DAC47CEA1DD38C205EB68AECA38AA8F49F6158484B01E35BBD8E4662472A78E33F65710A61D754C63000BADF885CB939B0E7
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS..+...c.<..)......^^....F.[..K.\o0..kIJ"....e"...Rh.X...).....nGZ.......*.....@)..>(....E...KXd...b.".f...Y.]N.....gkZ..N..=.,....F...Z.O.t=&.#j1...?..|.k.......I..`....O..$R..ca\7..c.u.Fzr)bi...\.........VfQho..`r.......L.s......).......om.....z..I..'.;. .8dh.a......483.2.l...b._...Ie.........o...U.d....!...fEC..3...5...H.'w;.*..`..{.*.?.:O..,.....x.#.........B.1.e..<2!........O..eS..Y.....t.:vU../k.L.2-.8b..b. .9T.k5z....|V.Mc..l+...^..S. .g...\..Il-.....k..ijp..I.7..N@[.G...l..Kv.E.......A.aM..[rN.%.']O5.8a?yN. ....a5D7T...^......Nd...=#w.mw.[q.,....'.ct.....w...s...B.....J....Jwj...)..G.# ...{...f...Y..........N6!.8....1R..KrV.......f....s..|.ne.Z..".W.5t.....,6...Q9X<.x:.f..>!u,.I.,q1HMY.Jl(.....g..=.d._....o..y7.............=@.~a..Q#.1....%..5....<#.~....EC..t..D;.[:..Res}...r.}....C0c_.. ..m.......k.....e..&.rW.gJ........biV6.N.i. ..b....E..#w...........v.t:....4G...<...L~.o.m.o..^..V.7t.h.G.A..H&#..e.....p.V.|f..r

                                                                        C:\Users\user\Documents\MXPXCVPDVN\SFPUSAFIOL.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.867900285910913
                                                                        Encrypted:false
                                                                        SSDEEP:24:NnFhZAbdhsBIaw/YvygIi4Mf7RWaUJ3S8RVldq4FT3ZDw+zWbD:NvydhsBIsK6FUnVVFjdw+wD
                                                                        MD5:3035346185E58961CD848E92B4CEE74C
                                                                        SHA1:FAB3ACE462E8ED3730BFF19C2DE87F87F529ADCA
                                                                        SHA-256:BE64F963DFF7EE8639D4F50365660576D489FBC67A8EA1A670F181BD9D131B70
                                                                        SHA-512:439E05A54AF41603E0E5FC972913DAC47CEA1DD38C205EB68AECA38AA8F49F6158484B01E35BBD8E4662472A78E33F65710A61D754C63000BADF885CB939B0E7
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS..+...c.<..)......^^....F.[..K.\o0..kIJ"....e"...Rh.X...).....nGZ.......*.....@)..>(....E...KXd...b.".f...Y.]N.....gkZ..N..=.,....F...Z.O.t=&.#j1...?..|.k.......I..`....O..$R..ca\7..c.u.Fzr)bi...\.........VfQho..`r.......L.s......).......om.....z..I..'.;. .8dh.a......483.2.l...b._...Ie.........o...U.d....!...fEC..3...5...H.'w;.*..`..{.*.?.:O..,.....x.#.........B.1.e..<2!........O..eS..Y.....t.:vU../k.L.2-.8b..b. .9T.k5z....|V.Mc..l+...^..S. .g...\..Il-.....k..ijp..I.7..N@[.G...l..Kv.E.......A.aM..[rN.%.']O5.8a?yN. ....a5D7T...^......Nd...=#w.mw.[q.,....'.ct.....w...s...B.....J....Jwj...)..G.# ...{...f...Y..........N6!.8....1R..KrV.......f....s..|.ne.Z..".W.5t.....,6...Q9X<.x:.f..>!u,.I.,q1HMY.Jl(.....g..=.d._....o..y7.............=@.~a..Q#.1....%..5....<#.~....EC..t..D;.[:..Res}...r.}....C0c_.. ..m.......k.....e..&.rW.gJ........biV6.N.i. ..b....E..#w...........v.t:....4G...<...L~.o.m.o..^..V.7t.h.G.A..H&#..e.....p.V.|f..r

                                                                        C:\Users\user\Documents\MXPXCVPDVN\ZQIXMVQGAH.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.868225854462205
                                                                        Encrypted:false
                                                                        SSDEEP:24:trb6VPbunvave0bi/L9ajnOhFRA9zyPolRI1ieq6f7kCXVR03JUKfBsQhpXjGAnQ:tH6ZuvaGoKLkrOGRyPEO1nquICXVS330
                                                                        MD5:9812A433C736A047F7AEA71DFAF28ACC
                                                                        SHA1:F1DB5F0B0E6CA944BD62398C0F3A217CCAFA54A4
                                                                        SHA-256:66A82200166A836CCD6044AB8F949F3B3F364C86143FE5B209F8A2205CF039DA
                                                                        SHA-512:71FBACE71AFC5DB3DF0ACEB1C83B8EA37CE83F4890D457BA2A9DF64A6461B0E771664A7377C676C066E8D7FC368B01D7C3746BDCBA363E5323F39D743C3538FC
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM-.2.T3u.m..F......W..9.+.|.....<.3k..........W.3;.C.....e... .J.y...z..;S..e}...I.6....2a..H..]V.*...@..~..9..2&...2....<....D.....|.5..P..h.)+.......XB..Q...?A..N...6.qB..R.'.~(..#^'o.VW")......Z..'...=..)..:.b*K.*nM.".....A........yl..c9....k..#...G.G..G}L.y.0..&Y.......`..Q...r..W.v4.0[.-..I.<cJ[.?.. ......}G"wN..6...R....|F".8....eMd~.g.s..9...$...8...&..!.....x.-4g.....{.x..........5!.fAJ;.YU.Egg.1.L.B..*....L..E.L...... .....T..I...].....\.3]M.....S,e..2..O..[).#X.@.....N.a..r3.z.T..u.T.Q...j...D...P.T......|2}.......!.%Z,...i........s.y.E%.Z.K..84d{(R.."&...8B.D.".Z..`1. N..0..6...E8Hw.y..n.f...k..)......K.X.w.....L._.1. ..,..%Oo|.L.W...M...t..[.....F|..RQ../&.K.Cc.je.vN..s..E.+.k..^..D.y.>..;...k..:.P.T.Bo..;!......I......7......I1.B.......|.Xk..[..qX..\...K...nxtwp.....q..X...I.o#a.O.I...UA....e.y#.f...,`..J../G......QP....!.~.:y.......c.......[.*..q..C..A.....q|[..u]......+..x.w"....X>.i<J.s.0...F.C'.......s.

                                                                        C:\Users\user\Documents\MXPXCVPDVN\ZQIXMVQGAH.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.868225854462205
                                                                        Encrypted:false
                                                                        SSDEEP:24:trb6VPbunvave0bi/L9ajnOhFRA9zyPolRI1ieq6f7kCXVR03JUKfBsQhpXjGAnQ:tH6ZuvaGoKLkrOGRyPEO1nquICXVS330
                                                                        MD5:9812A433C736A047F7AEA71DFAF28ACC
                                                                        SHA1:F1DB5F0B0E6CA944BD62398C0F3A217CCAFA54A4
                                                                        SHA-256:66A82200166A836CCD6044AB8F949F3B3F364C86143FE5B209F8A2205CF039DA
                                                                        SHA-512:71FBACE71AFC5DB3DF0ACEB1C83B8EA37CE83F4890D457BA2A9DF64A6461B0E771664A7377C676C066E8D7FC368B01D7C3746BDCBA363E5323F39D743C3538FC
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM-.2.T3u.m..F......W..9.+.|.....<.3k..........W.3;.C.....e... .J.y...z..;S..e}...I.6....2a..H..]V.*...@..~..9..2&...2....<....D.....|.5..P..h.)+.......XB..Q...?A..N...6.qB..R.'.~(..#^'o.VW")......Z..'...=..)..:.b*K.*nM.".....A........yl..c9....k..#...G.G..G}L.y.0..&Y.......`..Q...r..W.v4.0[.-..I.<cJ[.?.. ......}G"wN..6...R....|F".8....eMd~.g.s..9...$...8...&..!.....x.-4g.....{.x..........5!.fAJ;.YU.Egg.1.L.B..*....L..E.L...... .....T..I...].....\.3]M.....S,e..2..O..[).#X.@.....N.a..r3.z.T..u.T.Q...j...D...P.T......|2}.......!.%Z,...i........s.y.E%.Z.K..84d{(R.."&...8B.D.".Z..`1. N..0..6...E8Hw.y..n.f...k..)......K.X.w.....L._.1. ..,..%Oo|.L.W...M...t..[.....F|..RQ../&.K.Cc.je.vN..s..E.+.k..^..D.y.>..;...k..:.P.T.Bo..;!......I......7......I1.B.......|.Xk..[..qX..\...K...nxtwp.....q..X...I.o#a.O.I...UA....e.y#.f...,`..J../G......QP....!.~.:y.......c.......[.*..q..C..A.....q|[..u]......+..x.w"....X>.i<J.s.0...F.C'.......s.

                                                                        C:\Users\user\Documents\NEBFQQYWPS.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865734038550018
                                                                        Encrypted:false
                                                                        SSDEEP:24:/YkVrDgRR1VFUY8KnKKAaS+iCl/VYQJ3F/+RGee8KI3o0czeTT+dYPWbD:rIvUOKT3+bReYd+R6Yfczw+LD
                                                                        MD5:1FA06F53C236148AA0E4964E98EEE499
                                                                        SHA1:80B9FC05D5DAC17F350076AD96F7CA23D6C69AA2
                                                                        SHA-256:CAE22FEC5D93A3678485599227E40BC8E8976D77BB5C5A0BC3726FB0FE620F2E
                                                                        SHA-512:C8295F8B1197AC0F6450060B377C53F86171E0411AE9407ADC90F5AE499F83278D0CC90449115DFE4A2769C5BCA5259FAD956B5E41165280819A921093463531
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ.7MT..0g...?}.6b;.dQ..m....p..,8K....Z%.|.S".?!Y..o...#......g.....c.......L.jd.xk[.N..N.rO@?.{.D{&../........^Z...,..i.:....X#.y..5...q.V..v.j$d.........\.l.....<%.x.j..V.....UW.....(..QP...{.9..C.....k..].C..C....y.....w..]..q;..!..z"C=p.+$q.H.l..D.........k..G....N.....%72...&..p...h.H .c..S..._.t.gp..Z.9[e...{..<h~...J..m?5..ml.r.......\.t.9...LD.4.q..k.ik.R...?..........b....S..5..|5$.e.G.H...@$.l...&....4,E...uQ.....3....,...c/S...l.....X.3.oz........%...E/^..*eU.&E.EspV....9.E...w..n3.*b.}....H.0..='...|.. ....)msB.U..\.I..<.m(..o.;L..c.q.PE.....jm...@d.....#.j>..K.SO..X...F.'.zWPy...T.......b..S...@._{...........&.E.Qh,..P..6...X/z...J.Y.L)vk.k.......I....{W.}.H.u.-S....$....s...x..2uG.. ...n...".{..L.m.$...fY.....n|7.^X...XC...J.#.._.+YE.`.b...#;.........Q1......DHR..8l...+D..iRTQ.d+..e#.....t(p..HF=i..*...9.Z...W.C.5.{...k...C....t...e.p|..S...T..K~h_IF..z...|ie..[..Lx........$..l.+...GCr.j.N.h.xX..#.~ H.L.=]......`.

                                                                        C:\Users\user\Documents\NEBFQQYWPS.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865734038550018
                                                                        Encrypted:false
                                                                        SSDEEP:24:/YkVrDgRR1VFUY8KnKKAaS+iCl/VYQJ3F/+RGee8KI3o0czeTT+dYPWbD:rIvUOKT3+bReYd+R6Yfczw+LD
                                                                        MD5:1FA06F53C236148AA0E4964E98EEE499
                                                                        SHA1:80B9FC05D5DAC17F350076AD96F7CA23D6C69AA2
                                                                        SHA-256:CAE22FEC5D93A3678485599227E40BC8E8976D77BB5C5A0BC3726FB0FE620F2E
                                                                        SHA-512:C8295F8B1197AC0F6450060B377C53F86171E0411AE9407ADC90F5AE499F83278D0CC90449115DFE4A2769C5BCA5259FAD956B5E41165280819A921093463531
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ.7MT..0g...?}.6b;.dQ..m....p..,8K....Z%.|.S".?!Y..o...#......g.....c.......L.jd.xk[.N..N.rO@?.{.D{&../........^Z...,..i.:....X#.y..5...q.V..v.j$d.........\.l.....<%.x.j..V.....UW.....(..QP...{.9..C.....k..].C..C....y.....w..]..q;..!..z"C=p.+$q.H.l..D.........k..G....N.....%72...&..p...h.H .c..S..._.t.gp..Z.9[e...{..<h~...J..m?5..ml.r.......\.t.9...LD.4.q..k.ik.R...?..........b....S..5..|5$.e.G.H...@$.l...&....4,E...uQ.....3....,...c/S...l.....X.3.oz........%...E/^..*eU.&E.EspV....9.E...w..n3.*b.}....H.0..='...|.. ....)msB.U..\.I..<.m(..o.;L..c.q.PE.....jm...@d.....#.j>..K.SO..X...F.'.zWPy...T.......b..S...@._{...........&.E.Qh,..P..6...X/z...J.Y.L)vk.k.......I....{W.}.H.u.-S....$....s...x..2uG.. ...n...".{..L.m.$...fY.....n|7.^X...XC...J.#.._.+YE.`.b...#;.........Q1......DHR..8l...+D..iRTQ.d+..e#.....t(p..HF=i..*...9.Z...W.C.5.{...k...C....t...e.p|..S...T..K~h_IF..z...|ie..[..Lx........$..l.+...GCr.j.N.h.xX..#.~ H.L.=]......`.

                                                                        C:\Users\user\Documents\NEBFQQYWPS.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.826382859184478
                                                                        Encrypted:false
                                                                        SSDEEP:24:KKoJK2Z/BozmQzA3zy3Iw+jMWXoEse4KH26h1vKJxHRNwXKvXwpI1qWzLLs2C+WX:KHUcT9W3IwaMYdlBWsvuHGpUP4drD
                                                                        MD5:2390E67CDDC9B4FD9467C88F4C7D9583
                                                                        SHA1:D43368C595C8C2CCC2E023EC20300DE2F63AD5AA
                                                                        SHA-256:6529B164C8747999F3669A79CA8E08468DBDE9A7825B148027FA5BEF42784606
                                                                        SHA-512:C5C1A861C548CB988B822B3D1F681B8460200F2E5246FC7CEB9FCA081E40E6391C2B4143E17679E3C0EAE52DAD8BE0138A7A1326B61AE99FABC1C571D222E254
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ.<-..+..r..h.......C..k..|...>.4ka..r..6.}Zm.......+.E..P.'qw..z.a.Y.?...4?..c.2...N GA..'......a......s4?.PI....y..k.t.@.`.:<.K6...f...Ah.(...I....S.A.0)/Y.]Q[*......JJ.+.I......~.%..;..8q7...!....C.US..O.....%..........j..g....5..hs.....AyU+....T....y.Y?"8.~.......q}......~...+....x..4.fs#x.p.....K..%opE..q..J:O<.....tQ?..YI..C7.Ht.0A..}72yf7...Q.......F..."o.P.^..[....6.?~'....I....?K.....Q.X...f.;...$..Q\H......XB.5..g..9..1..=........U..l#...I...n} ..`..D.+...........>.C...T[qv.3..........6Tk.$...`...V"1.qd..m8..(..C9#.r......qE.....62.w.:h.R.(XRZ..R..N.e...m.p....'.-.l1oz2.\.\f......1.*$l....#Qr4..VX.%...r` %.k.4t).huW.#...;.`+c.K....8..........I.TOF.3..0.J+,..;M....a...$.6CV..p_/.f....M.../.V..l...@....k..5........G.?P#b`5.3.=8.t.R..._...<.3.y.....}.r.;M..b.#t.p....:w.^.-.n).a..[h....K.%~.S.$....0...>.y...........H..x..W....wp.J.Hiq....\.+8\.M{...''f..b.Y..i...S=....v......q.r.T{.9.k..y5.S.;X.0W...X}[..=.;.~.Q..'1k.MNgY....FJCRV

                                                                        C:\Users\user\Documents\NEBFQQYWPS.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.826382859184478
                                                                        Encrypted:false
                                                                        SSDEEP:24:KKoJK2Z/BozmQzA3zy3Iw+jMWXoEse4KH26h1vKJxHRNwXKvXwpI1qWzLLs2C+WX:KHUcT9W3IwaMYdlBWsvuHGpUP4drD
                                                                        MD5:2390E67CDDC9B4FD9467C88F4C7D9583
                                                                        SHA1:D43368C595C8C2CCC2E023EC20300DE2F63AD5AA
                                                                        SHA-256:6529B164C8747999F3669A79CA8E08468DBDE9A7825B148027FA5BEF42784606
                                                                        SHA-512:C5C1A861C548CB988B822B3D1F681B8460200F2E5246FC7CEB9FCA081E40E6391C2B4143E17679E3C0EAE52DAD8BE0138A7A1326B61AE99FABC1C571D222E254
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ.<-..+..r..h.......C..k..|...>.4ka..r..6.}Zm.......+.E..P.'qw..z.a.Y.?...4?..c.2...N GA..'......a......s4?.PI....y..k.t.@.`.:<.K6...f...Ah.(...I....S.A.0)/Y.]Q[*......JJ.+.I......~.%..;..8q7...!....C.US..O.....%..........j..g....5..hs.....AyU+....T....y.Y?"8.~.......q}......~...+....x..4.fs#x.p.....K..%opE..q..J:O<.....tQ?..YI..C7.Ht.0A..}72yf7...Q.......F..."o.P.^..[....6.?~'....I....?K.....Q.X...f.;...$..Q\H......XB.5..g..9..1..=........U..l#...I...n} ..`..D.+...........>.C...T[qv.3..........6Tk.$...`...V"1.qd..m8..(..C9#.r......qE.....62.w.:h.R.(XRZ..R..N.e...m.p....'.-.l1oz2.\.\f......1.*$l....#Qr4..VX.%...r` %.k.4t).huW.#...;.`+c.K....8..........I.TOF.3..0.J+,..;M....a...$.6CV..p_/.f....M.../.V..l...@....k..5........G.?P#b`5.3.=8.t.R..._...<.3.y.....}.r.;M..b.#t.p....:w.^.-.n).a..[h....K.%~.S.$....0...>.y...........H..x..W....wp.J.Hiq....\.+8\.M{...''f..b.Y..i...S=....v......q.r.T{.9.k..y5.S.;X.0W...X}[..=.;.~.Q..'1k.MNgY....FJCRV

                                                                        C:\Users\user\Documents\Outlook Files\Outlook.pst

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Microsoft Outlook email folder
                                                                        Category:dropped
                                                                        Size (bytes):271694
                                                                        Entropy (8bit):5.499388701997617
                                                                        Encrypted:false
                                                                        SSDEEP:3072:8dfyvNpwnHX7e7IAzrOPAqF90VG9euz3vp69Ri9sww62+zjlo3N7/kPU:8F/XWhzi4qF90puDpaRimJOjlwN7/uU
                                                                        MD5:2F0C7FDBAE15741A6FE7F914613D100F
                                                                        SHA1:FA3D0F6F7CB477F819A101E2EEA4875EA967CE92
                                                                        SHA-256:381ED67C4F9D6235C12661162DB07EBC3352E81A5E9AB80CBAD3F08A3ED8A528
                                                                        SHA-512:E75EB2B19018C29FCAE05F0C5EED0D48FD44EF2C3AC5F4FC3EFD37B9CC9EAD8CAF07E1308AE1500068962B3E1328BB1719949FBF3A7745C02122D05D3898390E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:!BDN./..W..=Y....d..Ui.......H_.B...:]..4...f.q.<9.S......A.i..6..Pk....L|.X.%.'*f..G.....n-.LA7B...e.bJ..z.m{ ..8n.i%...3..&.zWh.....T(..4s.j...~.M...a....Q.Cr.d,...8.p.....k.A...y..B>.i...R"AO.6...M?.u.%.!...m.....;... <F...S......'.Ad.$@.....*`O....=.~....X[.OR'.6.V@L...g.....(/..$.gT.V..W..9..okc.v.O4h..f..*..<e.....;.k13..W..ac.....qtqB-]..9..?c...=....?.b'dkY...[..fJ.v...F*..q.u_.=`.zy0.......X.t......4.4ys..tD\V&.F./w@..U.........5....G.......57..sLb.1.l.qs.....c,.2..}..E...Oq...S,.e.."demC6.?c.k...j...^...Y.d...$..! .t>..Aowui.F*....e&.1..+xy.k...wT.^...!.r..X...& ..E.0.x.....4.h...........3.h.....#.x..at.>......E.n.5.}..@..HU.14.........$.U.)6........A......-...H.c.._...S..-.T. U1.Ec=.H@....^.....U.?..|E|.."k...\..~.h.~.9.x..(n.5.UL6.E...S.r.....p.....d... .F)......"..e. ?ob.....:.$Z....t..vD...)3...A.E....7.....E!i.B..2.......&.....'.3.co.l.ynV....n..d.$..%}],%..9.".=..ca2.....5 a..x..7...'.1|...rp..).xI.#..Z3..!^...@..xy%...mo+!m....

                                                                        C:\Users\user\Documents\Outlook Files\Outlook.pst.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Microsoft Outlook email folder
                                                                        Category:dropped
                                                                        Size (bytes):271694
                                                                        Entropy (8bit):5.499388701997617
                                                                        Encrypted:false
                                                                        SSDEEP:3072:8dfyvNpwnHX7e7IAzrOPAqF90VG9euz3vp69Ri9sww62+zjlo3N7/kPU:8F/XWhzi4qF90puDpaRimJOjlwN7/uU
                                                                        MD5:2F0C7FDBAE15741A6FE7F914613D100F
                                                                        SHA1:FA3D0F6F7CB477F819A101E2EEA4875EA967CE92
                                                                        SHA-256:381ED67C4F9D6235C12661162DB07EBC3352E81A5E9AB80CBAD3F08A3ED8A528
                                                                        SHA-512:E75EB2B19018C29FCAE05F0C5EED0D48FD44EF2C3AC5F4FC3EFD37B9CC9EAD8CAF07E1308AE1500068962B3E1328BB1719949FBF3A7745C02122D05D3898390E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:!BDN./..W..=Y....d..Ui.......H_.B...:]..4...f.q.<9.S......A.i..6..Pk....L|.X.%.'*f..G.....n-.LA7B...e.bJ..z.m{ ..8n.i%...3..&.zWh.....T(..4s.j...~.M...a....Q.Cr.d,...8.p.....k.A...y..B>.i...R"AO.6...M?.u.%.!...m.....;... <F...S......'.Ad.$@.....*`O....=.~....X[.OR'.6.V@L...g.....(/..$.gT.V..W..9..okc.v.O4h..f..*..<e.....;.k13..W..ac.....qtqB-]..9..?c...=....?.b'dkY...[..fJ.v...F*..q.u_.=`.zy0.......X.t......4.4ys..tD\V&.F./w@..U.........5....G.......57..sLb.1.l.qs.....c,.2..}..E...Oq...S,.e.."demC6.?c.k...j...^...Y.d...$..! .t>..Aowui.F*....e&.1..+xy.k...wT.^...!.r..X...& ..E.0.x.....4.h...........3.h.....#.x..at.>......E.n.5.}..@..HU.14.........$.U.)6........A......-...H.c.._...S..-.T. U1.Ec=.H@....^.....U.?..|E|.."k...\..~.h.~.9.x..(n.5.UL6.E...S.r.....p.....d... .F)......"..e. ?ob.....:.$Z....t..vD...)3...A.E....7.....E!i.B..2.......&.....'.3.co.l.ynV....n..d.$..%}],%..9.".=..ca2.....5 a..x..7...'.1|...rp..).xI.#..Z3..!^...@..xy%...mo+!m....

                                                                        C:\Users\user\Documents\PIVFAGEAAV.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8467639460529135
                                                                        Encrypted:false
                                                                        SSDEEP:24:W2QeooN2YNPFYnbEZAqdCXhMYU2FIgwr5eBxXg6D02hRkMlWbD:WdhoEYNCnb9Tm2FIxUXg6D0sRiD
                                                                        MD5:9A799B5A8C8A61BBA782D7ECD43B9458
                                                                        SHA1:F93F1D462F899CE639D6DC0B1D67129BC5966787
                                                                        SHA-256:A8D1EFE8D8FF0F99CF4B3FAAEB3A5C19E3EA2A9EB19FD7CD02D144EC70C3DC3E
                                                                        SHA-512:08D013109FA83B14286A2D085A39196D2B31E7718627AA4FD9F165917EC9EA3AA73A55ADCA2CEDA58A0BF760F65EFC0674453B21D93230A30176B494BA458684
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA_8..r.Y...'2.>._...%..!..)|.T.K+...[fv.....AA......ar+...x$...3..oJ....E\ =.....Je..9%.*P./.f.4.8....;....A..p.2..6X..#C.7.<e...L_..-.../. d.DLXq.....E|tct.C7....-[lD.........^.vw..}.U.W.sX.......EY.ru..\@o.3..-7...\...b...OR.!.F4..W.W..T..l6....\*....@......E?5_m..b.G.=2.. ......]q.$..o*.G..22..~q.{...~.q....|..e..,..yr.U.....Sg..N."....[..3....Q.c*,[#.M.k.F...y.e. ..g"B...n..f...$....\j....R.....j..n4..M.....~P.E.|...N......Kdn.....F=.O.\}..Z.-(....|...10...........J.w.v....../fj..*.VT....1 .....R......+'{w}zlGKU,.<.s.y..M'...uR..~~^....[d1Wh}..h..}e..Ew........U;.i`.;...mR>... .$2.M.u.?Q..9".a..+k.OP.).g.9\..E.g-.. ..fU%(W...Q.?..Q~.....@..).!T....O...zq...&;.....;..3.z.V..n.2.l.s'"Z+......V....&......!4..../p...}.M.......?.N.t.......#.....>....t.....J.0......_&.[.Afr.?.....-.:.x l.4........4".k...D.,.Q"uYRM9r$q.%......?.LP.E.....=,...1...#.........{-ns..j.3.z..o..k.d..9b......E......E..8...95V~.hU..A.......K....qw..S.s.....O.....

                                                                        C:\Users\user\Documents\PIVFAGEAAV.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8467639460529135
                                                                        Encrypted:false
                                                                        SSDEEP:24:W2QeooN2YNPFYnbEZAqdCXhMYU2FIgwr5eBxXg6D02hRkMlWbD:WdhoEYNCnb9Tm2FIxUXg6D0sRiD
                                                                        MD5:9A799B5A8C8A61BBA782D7ECD43B9458
                                                                        SHA1:F93F1D462F899CE639D6DC0B1D67129BC5966787
                                                                        SHA-256:A8D1EFE8D8FF0F99CF4B3FAAEB3A5C19E3EA2A9EB19FD7CD02D144EC70C3DC3E
                                                                        SHA-512:08D013109FA83B14286A2D085A39196D2B31E7718627AA4FD9F165917EC9EA3AA73A55ADCA2CEDA58A0BF760F65EFC0674453B21D93230A30176B494BA458684
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA_8..r.Y...'2.>._...%..!..)|.T.K+...[fv.....AA......ar+...x$...3..oJ....E\ =.....Je..9%.*P./.f.4.8....;....A..p.2..6X..#C.7.<e...L_..-.../. d.DLXq.....E|tct.C7....-[lD.........^.vw..}.U.W.sX.......EY.ru..\@o.3..-7...\...b...OR.!.F4..W.W..T..l6....\*....@......E?5_m..b.G.=2.. ......]q.$..o*.G..22..~q.{...~.q....|..e..,..yr.U.....Sg..N."....[..3....Q.c*,[#.M.k.F...y.e. ..g"B...n..f...$....\j....R.....j..n4..M.....~P.E.|...N......Kdn.....F=.O.\}..Z.-(....|...10...........J.w.v....../fj..*.VT....1 .....R......+'{w}zlGKU,.<.s.y..M'...uR..~~^....[d1Wh}..h..}e..Ew........U;.i`.;...mR>... .$2.M.u.?Q..9".a..+k.OP.).g.9\..E.g-.. ..fU%(W...Q.?..Q~.....@..).!T....O...zq...&;.....;..3.z.V..n.2.l.s'"Z+......V....&......!4..../p...}.M.......?.N.t.......#.....>....t.....J.0......_&.[.Afr.?.....-.:.x l.4........4".k...D.,.Q"uYRM9r$q.%......?.LP.E.....=,...1...#.........{-ns..j.3.z..o..k.d..9b......E......E..8...95V~.hU..A.......K....qw..S.s.....O.....

                                                                        C:\Users\user\Documents\PIVFAGEAAV.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865340737459228
                                                                        Encrypted:false
                                                                        SSDEEP:24:jBWtJnE8dgmDpv/ZrxXUOb2fx603HmVTM7F3appjj19eszv0Dw4xWbD:ct5Xdg89ZtXJ02VT+4jj19RvSgD
                                                                        MD5:99077E59473ADBFB2EC1635B376AD7FD
                                                                        SHA1:4EE7F7332054CACA03961C686651C666DEB1B282
                                                                        SHA-256:7DB3E2CAFB5F3F69F9CE1CDE450B74F167E9F693C263CAAAB954D95E38174B1F
                                                                        SHA-512:84A5DC79404A1DD60E3C7687CEE81DEE314CEEEED38DAA1D88824C9288D4160181F60E7B29CAE3351B22CAB78AE9807AC4EB1B067302AEDC2E30FACFD547E898
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAx.../=y..S.|}...;.\..G."..Y8....N_.4.-W.$'..c.}Oc../.lE'...d.h...^@..K.t.o.v.i..~...>.uw.:......J.)...OT.{.D..uZ.j.26.....i..>I0sD.&Z.....i;.ga..I.z.... ..5m.&..........B{..c...G.'..)n....NO72.O....].A..Y......f.2Mno...I\".&.-p.R..:..:i.7>.#47k..+.S........p..Y.g|!...$../.D...=.I..bh....at>r.,....] ..`b._.<H..G.....V.H.p...>.0V!..:.8.a..nr.R..L!..3K........l8.-I..D.....i..>....R.....h8.C.u.2....f0......h..M..BY.n......'..P^...N0m.:(.k. ............2(......y.=.xw.tx].Ad..T..U.T......T+......<....wF.igI.......x.......mX......9.+..`.<j..b..M...!...&OsY.Z...C.Ca.#.....t. .s...K......au..V...5v..jk.}.+.w.d!...!..jnh..........k~.+#..).i......>yqgI..~....Z9.....@(.....2.b....72.......k|.z.;..".1......A..S...z.)z...\G.a....K.I..vj.C.:.;...o2%4_]o.?.....4.7.;....|.H.b..../.....K..S..7P.+...]..x..>.6............kDj2k.........m_Sd)a.'..Q........O..M7NY......(J.u^+...W...9..\0#...$.`...S.W..Z.^zh8...C..*....'.,...../.j.....:..vQ..w./.F

                                                                        C:\Users\user\Documents\PIVFAGEAAV.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.865340737459228
                                                                        Encrypted:false
                                                                        SSDEEP:24:jBWtJnE8dgmDpv/ZrxXUOb2fx603HmVTM7F3appjj19eszv0Dw4xWbD:ct5Xdg89ZtXJ02VT+4jj19RvSgD
                                                                        MD5:99077E59473ADBFB2EC1635B376AD7FD
                                                                        SHA1:4EE7F7332054CACA03961C686651C666DEB1B282
                                                                        SHA-256:7DB3E2CAFB5F3F69F9CE1CDE450B74F167E9F693C263CAAAB954D95E38174B1F
                                                                        SHA-512:84A5DC79404A1DD60E3C7687CEE81DEE314CEEEED38DAA1D88824C9288D4160181F60E7B29CAE3351B22CAB78AE9807AC4EB1B067302AEDC2E30FACFD547E898
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFAx.../=y..S.|}...;.\..G."..Y8....N_.4.-W.$'..c.}Oc../.lE'...d.h...^@..K.t.o.v.i..~...>.uw.:......J.)...OT.{.D..uZ.j.26.....i..>I0sD.&Z.....i;.ga..I.z.... ..5m.&..........B{..c...G.'..)n....NO72.O....].A..Y......f.2Mno...I\".&.-p.R..:..:i.7>.#47k..+.S........p..Y.g|!...$../.D...=.I..bh....at>r.,....] ..`b._.<H..G.....V.H.p...>.0V!..:.8.a..nr.R..L!..3K........l8.-I..D.....i..>....R.....h8.C.u.2....f0......h..M..BY.n......'..P^...N0m.:(.k. ............2(......y.=.xw.tx].Ad..T..U.T......T+......<....wF.igI.......x.......mX......9.+..`.<j..b..M...!...&OsY.Z...C.Ca.#.....t. .s...K......au..V...5v..jk.}.+.w.d!...!..jnh..........k~.+#..).i......>yqgI..~....Z9.....@(.....2.b....72.......k|.z.;..".1......A..S...z.)z...\G.a....K.I..vj.C.:.;...o2%4_]o.?.....4.7.;....|.H.b..../.....K..S..7P.+...]..x..>.6............kDj2k.........m_Sd)a.'..Q........O..M7NY......(J.u^+...W...9..\0#...$.`...S.W..Z.^zh8...C..*....'.,...../.j.....:..vQ..w./.F

                                                                        C:\Users\user\Documents\PWCCAWLGRE.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.881377113748648
                                                                        Encrypted:false
                                                                        SSDEEP:24:AVOzEL58sP3sqNHOQf/NNBa60o5E9L+OUQqQDZgd5rfoWqXGMcrPWbD:AAolDP3sqNHOQtbv0oEVUQqQDq5kpXGe
                                                                        MD5:F718B485EDE2EF59F57CA9B6444CA276
                                                                        SHA1:2387EDFFB70F2AB9FD1B60775EA5247D5B391358
                                                                        SHA-256:55C59B51285E8DBC7DBE12DF2B970DD61E5536FF6ECC1724926AE6BC58DCEA32
                                                                        SHA-512:F9E542A2877EB865E4E6C6C30532FCE04B3B757A154118CC078337FF345B8F664825CFB600C171B68C367B50F77E1C556B1AF983F40B27A16DDD92E68B004AA5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA..,D..<..|/..Pb..Q.....6...=2...$..d......b.n|...lI.`.2E.....vy...g.YXKD.X...w.L.T....g.8.LB&CHa.z.H..K......G..#..(;]>>L..p/](.O..~3..?... y.v.. ..j..)..o^.=.G.y_......g.f....;D.6...h.~...B.....8[)>.xa..#R..m..-..d..l...:.......[.<...7.......V...4o.S_..........1......TT.y.Z.!.{3.rsP..L..w}tUXWK.N...{X..6......,...&..d..."h...p.LJ.....u2+...-./u.x.!!....B3Q..8w.BH.F.:D.tM...@....u...3<1=....Au.A.t.n....D1~..$....^......6...BP..9.M..g...=P..t..Y.g...j.<......6-.rf...e.U.+)...q..O^.Pd..s!.1..........L...P.l...(^\'r...R/w..A~...C...f.L..\.!.....(@V..X../.P"@.....t..b..P...w...M...U........A....I.$.\..9../ww..}.N.;......A|@b?S....{>.h$..2...]......h....HBC..Q=...M.:..}JO+....A. .r.._...D...|.c..;..Y.=.!..FR.......B.E.$.m...z.......s....Hd..#...n].F..C...W.,.(um.I.....dk..{r.#.......mlIY].%`.%......j..=...M.._-.T._.}m...D...=n{...........a_.j8..u$..:.1.`~......)..J.s.. ....h....W..u...=.$.....,p...Cl.....x@...YH...[.OmW....Z..`.

                                                                        C:\Users\user\Documents\PWCCAWLGRE.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.881377113748648
                                                                        Encrypted:false
                                                                        SSDEEP:24:AVOzEL58sP3sqNHOQf/NNBa60o5E9L+OUQqQDZgd5rfoWqXGMcrPWbD:AAolDP3sqNHOQtbv0oEVUQqQDq5kpXGe
                                                                        MD5:F718B485EDE2EF59F57CA9B6444CA276
                                                                        SHA1:2387EDFFB70F2AB9FD1B60775EA5247D5B391358
                                                                        SHA-256:55C59B51285E8DBC7DBE12DF2B970DD61E5536FF6ECC1724926AE6BC58DCEA32
                                                                        SHA-512:F9E542A2877EB865E4E6C6C30532FCE04B3B757A154118CC078337FF345B8F664825CFB600C171B68C367B50F77E1C556B1AF983F40B27A16DDD92E68B004AA5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA..,D..<..|/..Pb..Q.....6...=2...$..d......b.n|...lI.`.2E.....vy...g.YXKD.X...w.L.T....g.8.LB&CHa.z.H..K......G..#..(;]>>L..p/](.O..~3..?... y.v.. ..j..)..o^.=.G.y_......g.f....;D.6...h.~...B.....8[)>.xa..#R..m..-..d..l...:.......[.<...7.......V...4o.S_..........1......TT.y.Z.!.{3.rsP..L..w}tUXWK.N...{X..6......,...&..d..."h...p.LJ.....u2+...-./u.x.!!....B3Q..8w.BH.F.:D.tM...@....u...3<1=....Au.A.t.n....D1~..$....^......6...BP..9.M..g...=P..t..Y.g...j.<......6-.rf...e.U.+)...q..O^.Pd..s!.1..........L...P.l...(^\'r...R/w..A~...C...f.L..\.!.....(@V..X../.P"@.....t..b..P...w...M...U........A....I.$.\..9../ww..}.N.;......A|@b?S....{>.h$..2...]......h....HBC..Q=...M.:..}JO+....A. .r.._...D...|.c..;..Y.=.!..FR.......B.E.$.m...z.......s....Hd..#...n].F..C...W.,.(um.I.....dk..{r.#.......mlIY].%`.%......j..=...M.._-.T._.}m...D...=n{...........a_.j8..u$..:.1.`~......)..J.s.. ....h....W..u...=.$.....,p...Cl.....x@...YH...[.OmW....Z..`.

                                                                        C:\Users\user\Documents\QCFWYSKMHA.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.858508275629852
                                                                        Encrypted:false
                                                                        SSDEEP:24:IRynxbAHtT0GtGJA+iCODe9OhEI18wBBZ7FxosqMOXrucvxkMomgjXOgQNEwtX/5:IEatoFJRhgAZI18WBZ7FxosEXruH1jXg
                                                                        MD5:DF2536AEDD4846BC354975A898A4DAE8
                                                                        SHA1:5CDC0F80AD7A2D710CA328F553FF648D790AB8EE
                                                                        SHA-256:DDF5D50EAF228174C478A7386AFB3179092654D4D9DBF2CC67C705B024697007
                                                                        SHA-512:C3E714A5B14DCA6FC0B92DD13C030EC179CC9B9E988FD154ED3B0730A9096E4ADEC955B3CDF5249BFFAB26B1536A828BB68A0CC6580A8B1994BC709BCEF07237
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY1....s/"..._R..NW...U<..m;......,Dz......T..3...U)..>W..`..H..dZ.....8vj@z.(.aU.-9....=....2~.a...r.(C.....j.6...DUxY..Q...7J.*..@..Pn.`e....p.m.R-....2..an....._O.....B\b..AkP>..3....)q..]Z.~.\..'s.....Iv.5U>F...=.,.&.h......z.|eD.Csg...]..)2...p...)..;....|...S.,...!;.....q.:.fcHl..`..0...w..`.S..\.m....O_..4..%.~O......eRm$G._...M...{....5K&.F&i...WDO..\z....sg...L.}W..{(..........=+..w..pa...4n@.....f f.W.OF..'......o.._...{i.:u..g.O..?e$^.u.....S...:.-Z.'.r..N9Ib>.Bt..|...x...tY..s...9..H....C...H;..<.]..|......DV.~.E.yL...._.#7pD.V....M..g..,.T.=.YU.\-..M.j..9.....$.....x.:.........T....@..FMA..KU.g.{..t.OW..MJ{...MZb...YE.8.....L..;Kf.i...c....U....I.`.k).x*....o$J..#\....=...va)..XG_Ip@Z.....i..B.>..h........{d.9....'8....j<..l%|.w.v...>.SM.7..|....R.>k.~.._'.a..3..afy..8.}..{...].e...nV+\n..OB.....{......s.o..}W.3},e3O..i.....@...;*...,i.T......~....t.....2......XfK .deQq...u.h.V+.......@4..q29u.)...$...2&.x..z...

                                                                        C:\Users\user\Documents\QCFWYSKMHA.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.858508275629852
                                                                        Encrypted:false
                                                                        SSDEEP:24:IRynxbAHtT0GtGJA+iCODe9OhEI18wBBZ7FxosqMOXrucvxkMomgjXOgQNEwtX/5:IEatoFJRhgAZI18WBZ7FxosEXruH1jXg
                                                                        MD5:DF2536AEDD4846BC354975A898A4DAE8
                                                                        SHA1:5CDC0F80AD7A2D710CA328F553FF648D790AB8EE
                                                                        SHA-256:DDF5D50EAF228174C478A7386AFB3179092654D4D9DBF2CC67C705B024697007
                                                                        SHA-512:C3E714A5B14DCA6FC0B92DD13C030EC179CC9B9E988FD154ED3B0730A9096E4ADEC955B3CDF5249BFFAB26B1536A828BB68A0CC6580A8B1994BC709BCEF07237
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY1....s/"..._R..NW...U<..m;......,Dz......T..3...U)..>W..`..H..dZ.....8vj@z.(.aU.-9....=....2~.a...r.(C.....j.6...DUxY..Q...7J.*..@..Pn.`e....p.m.R-....2..an....._O.....B\b..AkP>..3....)q..]Z.~.\..'s.....Iv.5U>F...=.,.&.h......z.|eD.Csg...]..)2...p...)..;....|...S.,...!;.....q.:.fcHl..`..0...w..`.S..\.m....O_..4..%.~O......eRm$G._...M...{....5K&.F&i...WDO..\z....sg...L.}W..{(..........=+..w..pa...4n@.....f f.W.OF..'......o.._...{i.:u..g.O..?e$^.u.....S...:.-Z.'.r..N9Ib>.Bt..|...x...tY..s...9..H....C...H;..<.]..|......DV.~.E.yL...._.#7pD.V....M..g..,.T.=.YU.\-..M.j..9.....$.....x.:.........T....@..FMA..KU.g.{..t.OW..MJ{...MZb...YE.8.....L..;Kf.i...c....U....I.`.k).x*....o$J..#\....=...va)..XG_Ip@Z.....i..B.>..h........{d.9....'8....j<..l%|.w.v...>.SM.7..|....R.>k.~.._'.a..3..afy..8.}..{...].e...nV+\n..OB.....{......s.o..}W.3},e3O..i.....@...;*...,i.T......~....t.....2......XfK .deQq...u.h.V+.......@4..q29u.)...$...2&.x..z...

                                                                        C:\Users\user\Documents\QNCYCDFIJJ.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.835638824868571
                                                                        Encrypted:false
                                                                        SSDEEP:24:pHVkeAkcAt2imXyfaava7NNvFhw++57Y2xLgwzovWYL8n3oDPFX5dWbD:pKJlAt/tvCNzhoXxLgwkvWYA3oTPKD
                                                                        MD5:9035BEFF00A127481A64C03AE1C094C2
                                                                        SHA1:D1E1FF920331C7D795E9D15EBCB78FE092786C6D
                                                                        SHA-256:EFC09C119A36E84FCECC895EDFC7DD576003DD070C4A58D20A8E4CE80BE3FB0E
                                                                        SHA-512:36E4C0CDA98A4B6FAD2DED7A48652B73C54F91C6AF9175DDE03845A3B2043D63E13A03ABE8995F896A08F3922A35B88E14D370EA308180730C9881DBF7462ABE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC...L..^r....k&.....1.i.v..Y..y^.l..$.o;.r..qsb......W[0 .x... ......mmhMj+N+<.........{(.`..B_*..&..C6.....E&.f..1..K.u?-..NH.l..kCt..x....y...a.S.g..="..w.....F<.2.y{..!..(..?..L5t....^..Z..C4.W..q...o....!q.n/T....~.1!2t.F~Fo..9...r].H.h..w8l3..(..."}.2R......S.. .A..3........"....A-..2.....H.Bj.e.%.9g.~..9..G9?HN@..W.v!..S. .[.7...#.d.....XR._<.W..m)..'..u.?O:...r..D...!..%.Ev..AD...K_..h,..5..J`.p......b"@... D......v./..R.....c....b%yY.k...t.T.TaE[..-.....<.O..;?z._...}|.^.p......o......F.uv...U1..^}.&..s..u...:).L.00g...X..oc.P@..r7SO,%,`&..c\Z.^.q.gd....mw.E.x.l.!...w...]...v2+..U..jn..4uf...'.:F.........F?,.8S.&6..9...M.....{`cO1.I..\.*.fzu.....K.c...!s.\...f...Z..D..Tw....3.....9....^.....Me.a..I....B.T..D7..5.n....... .MV.#..V.?..o....Q...C...s.V..BK7..X..AMOX...E.u..b..s.r.v.....w..N..^.......w.....6...? .{.d..h.E.t%E..h....H...%$XAJ_.#..F.|i....2.6&.. ...Ur.+..P.@.*...J5.c.3.II..7I.........%..|&........T..'.l.j.0..h.....7.0;f

                                                                        C:\Users\user\Documents\QNCYCDFIJJ.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.835638824868571
                                                                        Encrypted:false
                                                                        SSDEEP:24:pHVkeAkcAt2imXyfaava7NNvFhw++57Y2xLgwzovWYL8n3oDPFX5dWbD:pKJlAt/tvCNzhoXxLgwkvWYA3oTPKD
                                                                        MD5:9035BEFF00A127481A64C03AE1C094C2
                                                                        SHA1:D1E1FF920331C7D795E9D15EBCB78FE092786C6D
                                                                        SHA-256:EFC09C119A36E84FCECC895EDFC7DD576003DD070C4A58D20A8E4CE80BE3FB0E
                                                                        SHA-512:36E4C0CDA98A4B6FAD2DED7A48652B73C54F91C6AF9175DDE03845A3B2043D63E13A03ABE8995F896A08F3922A35B88E14D370EA308180730C9881DBF7462ABE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC...L..^r....k&.....1.i.v..Y..y^.l..$.o;.r..qsb......W[0 .x... ......mmhMj+N+<.........{(.`..B_*..&..C6.....E&.f..1..K.u?-..NH.l..kCt..x....y...a.S.g..="..w.....F<.2.y{..!..(..?..L5t....^..Z..C4.W..q...o....!q.n/T....~.1!2t.F~Fo..9...r].H.h..w8l3..(..."}.2R......S.. .A..3........"....A-..2.....H.Bj.e.%.9g.~..9..G9?HN@..W.v!..S. .[.7...#.d.....XR._<.W..m)..'..u.?O:...r..D...!..%.Ev..AD...K_..h,..5..J`.p......b"@... D......v./..R.....c....b%yY.k...t.T.TaE[..-.....<.O..;?z._...}|.^.p......o......F.uv...U1..^}.&..s..u...:).L.00g...X..oc.P@..r7SO,%,`&..c\Z.^.q.gd....mw.E.x.l.!...w...]...v2+..U..jn..4uf...'.:F.........F?,.8S.&6..9...M.....{`cO1.I..\.*.fzu.....K.c...!s.\...f...Z..D..Tw....3.....9....^.....Me.a..I....B.T..D7..5.n....... .MV.#..V.?..o....Q...C...s.V..BK7..X..AMOX...E.u..b..s.r.v.....w..N..^.......w.....6...? .{.d..h.E.t%E..h....H...%$XAJ_.#..F.|i....2.6&.. ...Ur.+..P.@.*...J5.c.3.II..7I.........%..|&........T..'.l.j.0..h.....7.0;f

                                                                        C:\Users\user\Documents\SFPUSAFIOL.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.849953496297811
                                                                        Encrypted:false
                                                                        SSDEEP:24:1mcpbiKi38QvulDAmJufA/S7D2WpehTEwxDvkk6ivdLkeOI1e5b1WbD:11pzIxm7cYa7jehQmD8M1yI1elyD
                                                                        MD5:A9CD7AE4746B57769314758813363361
                                                                        SHA1:B75A663DC78179FB2F8BA548768B80656DEDE737
                                                                        SHA-256:C99A3366552F0A083E56E2E907853D43ED7F8A31FB21A7E0700DA76D73B1B50B
                                                                        SHA-512:CB18E23E2D7DF8650A3951AA2F016047D9E77CABEB0D3CAE306760FF50D7641A105490BCDDBA08D3ED213069056927D9930DEED63DC6C6275ABBFA51D3D26BAD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS....vU.a.d.d[#.|....k#SX].5f..(.#.d..v..0oIR..)...@..v../..&.:.Xd.|e......(Z...ka....].......'../.>.tw<cz.y..G...Z.M........N............xC....Ij...8...VI.=k....L.M.D...t...%JN...Zh.?..L../".. ..N..>:..C....E@:7...K|.....s^.l......js.f..gP;....!...).a._#u+.g./.?.\+e.X9.5...O....T.^tK...+_.W....C[ ...z...'...%....,..|>..J....."...g.=..:..+...x...<N..J....T..(..V.nM......g9<.P.H....n.l....1...'v.X..;x....pe..5..].A.5..u.4:..<O.)..g....|.b.s.$C..4.V|m.].....`.0...U..B..H.1p&..%..2#i..8><..Dp..`...oMn+..w.unu....xk...^+..7H..>J.....U;...n.,S.`.y..AS&..+......r...V....2%...<.V..`..Mzm.t..R.....4..<>.z.._[..+..:.d...F!.../...uzN[..}.7P......3.k...l...@.@....$pB$.._..c...Xw.JJG....Y...HOpj.7S)...C~...J.^...n. ....EKC.A..<..d..v.fX..<Ey.m.,.c.v.<...Q.-R..1.1.....M..h..Z..&.4."...+.5....4.h..7....LX]......0.s+.....w...K..7.E...3.O{s2<.?2.L0...W....e./}M.....J9.G9hu.#..gh.#+.%...5...U...z."uL.....V.....>..U.X..pu..F..j+.).L$9

                                                                        C:\Users\user\Documents\SFPUSAFIOL.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.849953496297811
                                                                        Encrypted:false
                                                                        SSDEEP:24:1mcpbiKi38QvulDAmJufA/S7D2WpehTEwxDvkk6ivdLkeOI1e5b1WbD:11pzIxm7cYa7jehQmD8M1yI1elyD
                                                                        MD5:A9CD7AE4746B57769314758813363361
                                                                        SHA1:B75A663DC78179FB2F8BA548768B80656DEDE737
                                                                        SHA-256:C99A3366552F0A083E56E2E907853D43ED7F8A31FB21A7E0700DA76D73B1B50B
                                                                        SHA-512:CB18E23E2D7DF8650A3951AA2F016047D9E77CABEB0D3CAE306760FF50D7641A105490BCDDBA08D3ED213069056927D9930DEED63DC6C6275ABBFA51D3D26BAD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS....vU.a.d.d[#.|....k#SX].5f..(.#.d..v..0oIR..)...@..v../..&.:.Xd.|e......(Z...ka....].......'../.>.tw<cz.y..G...Z.M........N............xC....Ij...8...VI.=k....L.M.D...t...%JN...Zh.?..L../".. ..N..>:..C....E@:7...K|.....s^.l......js.f..gP;....!...).a._#u+.g./.?.\+e.X9.5...O....T.^tK...+_.W....C[ ...z...'...%....,..|>..J....."...g.=..:..+...x...<N..J....T..(..V.nM......g9<.P.H....n.l....1...'v.X..;x....pe..5..].A.5..u.4:..<O.)..g....|.b.s.$C..4.V|m.].....`.0...U..B..H.1p&..%..2#i..8><..Dp..`...oMn+..w.unu....xk...^+..7H..>J.....U;...n.,S.`.y..AS&..+......r...V....2%...<.V..`..Mzm.t..R.....4..<>.z.._[..+..:.d...F!.../...uzN[..}.7P......3.k...l...@.@....$pB$.._..c...Xw.JJG....Y...HOpj.7S)...C~...J.^...n. ....EKC.A..<..d..v.fX..<Ey.m.,.c.v.<...Q.-R..1.1.....M..h..Z..&.4."...+.5....4.h..7....LX]......0.s+.....w...K..7.E...3.O{s2<.?2.L0...W....e./}M.....J9.G9hu.#..gh.#+.%...5...U...z."uL.....V.....>..U.X..pu..F..j+.).L$9

                                                                        C:\Users\user\Documents\SFPUSAFIOL.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.849823682211338
                                                                        Encrypted:false
                                                                        SSDEEP:24:K654gelcYq9EAEx3T5LUI13zbkgJoK4ONIo9DIhUZ9B//rymCnWbD:K654ZKYLRlUIzbkgJHWo9hZTsED
                                                                        MD5:78D154C6D29092FB2377A76DE51CF0F1
                                                                        SHA1:6A5BEDB5DB4D29B3177F1C2353796E161EA1C42B
                                                                        SHA-256:FF0703F8D6E75D9BBAA2543FD90867A9AAB7106C77C7FC990D8C5328DC58739D
                                                                        SHA-512:193A8414739C2851D7406EF3DAB49207B824DC17628BA4AA5AB84BF91A9BF95E344BFE64C0809CF58E158D35FFB83608EDE400219138ACE6F31F23C2CD446ADF
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS.......$../%..B.]t]...2........vF2./.d.q#..C...03."t..5.....c..G......~.T..+....o,u......9..v. ...t.A.!.nP...K.;......%e..@A3...'.mR..*..u..7.+.....}..........X.k.I.Sh~ }.I..O.;...$^.A..h^...e........i.p.SK.H...........i..^......:uD...(`.p...U].....N...-B.vE.........[,r..S..QW..E..Z~H]"lN.km.b....fs .-F6......>....2..oC...K..^..[.X.VX.).bE..>~....|...j@.....v8.6..J......?Y.%7.;).....U}$.......%iM.....A.w...A?...._..*JM....S.@...O}.-#.D.....l7vF..f..1S..|-.k.U.=..>!...l....G..H.e.7C+.I.CG...?.....O?]..*!j`E...V..n.-.....=.h2I..)c.....iA...s.......d...1N....d.D..f..J.....0e"2.o.E}..a.|.@...p.w....g,...d....f~f./. ..c5.ev..+...*?...%...@3..]M-...H....3..D,<:L....v..+p...Q..6.7..4..;.R.+.9Q....b..l..2....b.%.K...C.L...o.X..........#..:.~...W....a.l..KI..hl~&....;..../...X..s`.i.0.^.w>..8..r......t._./....Q.J..o...:$.R..|.5.../.,.,d..f.m......j.P..xo........LW........(..n.7..|...Nyd.R.|.+..Ap....Ux..8^...YN..`.e$.J..T........j..h;.lj...9+.,.

                                                                        C:\Users\user\Documents\SFPUSAFIOL.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.849823682211338
                                                                        Encrypted:false
                                                                        SSDEEP:24:K654gelcYq9EAEx3T5LUI13zbkgJoK4ONIo9DIhUZ9B//rymCnWbD:K654ZKYLRlUIzbkgJHWo9hZTsED
                                                                        MD5:78D154C6D29092FB2377A76DE51CF0F1
                                                                        SHA1:6A5BEDB5DB4D29B3177F1C2353796E161EA1C42B
                                                                        SHA-256:FF0703F8D6E75D9BBAA2543FD90867A9AAB7106C77C7FC990D8C5328DC58739D
                                                                        SHA-512:193A8414739C2851D7406EF3DAB49207B824DC17628BA4AA5AB84BF91A9BF95E344BFE64C0809CF58E158D35FFB83608EDE400219138ACE6F31F23C2CD446ADF
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS.......$../%..B.]t]...2........vF2./.d.q#..C...03."t..5.....c..G......~.T..+....o,u......9..v. ...t.A.!.nP...K.;......%e..@A3...'.mR..*..u..7.+.....}..........X.k.I.Sh~ }.I..O.;...$^.A..h^...e........i.p.SK.H...........i..^......:uD...(`.p...U].....N...-B.vE.........[,r..S..QW..E..Z~H]"lN.km.b....fs .-F6......>....2..oC...K..^..[.X.VX.).bE..>~....|...j@.....v8.6..J......?Y.%7.;).....U}$.......%iM.....A.w...A?...._..*JM....S.@...O}.-#.D.....l7vF..f..1S..|-.k.U.=..>!...l....G..H.e.7C+.I.CG...?.....O?]..*!j`E...V..n.-.....=.h2I..)c.....iA...s.......d...1N....d.D..f..J.....0e"2.o.E}..a.|.@...p.w....g,...d....f~f./. ..c5.ev..+...*?...%...@3..]M-...H....3..D,<:L....v..+p...Q..6.7..4..;.R.+.9Q....b..l..2....b.%.K...C.L...o.X..........#..:.~...W....a.l..KI..hl~&....;..../...X..s`.i.0.^.w>..8..r......t._./....Q.J..o...:$.R..|.5.../.,.,d..f.m......j.P..xo........LW........(..n.7..|...Nyd.R.|.+..Ap....Ux..8^...YN..`.e$.J..T........j..h;.lj...9+.,.

                                                                        C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.824922010460715
                                                                        Encrypted:false
                                                                        SSDEEP:24:8EcJjmVRFbf3wWzSog/qH1dxQXgpjf8fxxhGW+qjz9jqLoKE8qm1WuvdWbD:8EcUpbfleVK1dqJGKnmE8fZKD
                                                                        MD5:ED7AAA390AA74C0C70A74D5202CCD072
                                                                        SHA1:8AE303F45FBCB8FF6A6F9968C3CAD67BC4B5C846
                                                                        SHA-256:91964CF672572B51E7AF2D23A552AE003422F5E6E12DA1758CA713ADEB1751ED
                                                                        SHA-512:C23212B0CE53B351D6DC1ADB3E679F20CA8652A65F88495825365671EA758D4E71A434B11F01C6AB111A3E5EAD3841BF82FFAD9054A16236B9AF85955A56C70E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ~/.R..N8....i.8......)..x.\%.$.......%..8L.. ..cCi.......Xr...3... ......qL.....7.L*u....V.fZ..m....u...0.:F.A..X...h..d..C7U.052|...M.)|....A&bg.E..k|z.e2.cp.u;h..D....`.u..DCS.....}..+....=A.S.....0]...S....d.t.s..D....Zi..$.3v....*j.*....BB.V...'...../..[........}..A..D.,.\.mO.N}..n....m..^?&....v".......F.'.U.2e..-..%. ....Zx2T.....uF3.S.J..T(..E6h[..2.gJ{.{f.Cg.".0.kE...s00.0.....^..^..D...z...ru....D(....D.KJ8r...........D...<.#?.k.pZ..........$..K1...Y....H#w.)...[y...~^...Fj..rnf..Q.-.z.'..:.x+.,8w.-.#...3l...v..<..gx '.Y.-.|.........Iw.`07\.iwG..~.(...U...0`cA..Gz..rE.6|d.o....).@..9...+..k..........U..z,.J(.pZ.Z..u$hm.9...=.<tc,b....B6..Z.IC....g .<.)t......).........^.c.z..~.W..NO..'YvN..............#.).........g...x..t...I.O.{5$...`B..h~d...{...U.....,#...;.&....ASw.....,1i..C.F1.r.......W...L}..v..'..B..tJ..A.L........4A..F.D.k..s.E..G..Dy..4.~.Y..=...10..2I.R.T...R..`..3.:X...}G..U..+...#i...|.@..r...\4q..M..

                                                                        C:\Users\user\Documents\SFPUSAFIOL\NEBFQQYWPS.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.824922010460715
                                                                        Encrypted:false
                                                                        SSDEEP:24:8EcJjmVRFbf3wWzSog/qH1dxQXgpjf8fxxhGW+qjz9jqLoKE8qm1WuvdWbD:8EcUpbfleVK1dqJGKnmE8fZKD
                                                                        MD5:ED7AAA390AA74C0C70A74D5202CCD072
                                                                        SHA1:8AE303F45FBCB8FF6A6F9968C3CAD67BC4B5C846
                                                                        SHA-256:91964CF672572B51E7AF2D23A552AE003422F5E6E12DA1758CA713ADEB1751ED
                                                                        SHA-512:C23212B0CE53B351D6DC1ADB3E679F20CA8652A65F88495825365671EA758D4E71A434B11F01C6AB111A3E5EAD3841BF82FFAD9054A16236B9AF85955A56C70E
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ~/.R..N8....i.8......)..x.\%.$.......%..8L.. ..cCi.......Xr...3... ......qL.....7.L*u....V.fZ..m....u...0.:F.A..X...h..d..C7U.052|...M.)|....A&bg.E..k|z.e2.cp.u;h..D....`.u..DCS.....}..+....=A.S.....0]...S....d.t.s..D....Zi..$.3v....*j.*....BB.V...'...../..[........}..A..D.,.\.mO.N}..n....m..^?&....v".......F.'.U.2e..-..%. ....Zx2T.....uF3.S.J..T(..E6h[..2.gJ{.{f.Cg.".0.kE...s00.0.....^..^..D...z...ru....D(....D.KJ8r...........D...<.#?.k.pZ..........$..K1...Y....H#w.)...[y...~^...Fj..rnf..Q.-.z.'..:.x+.,8w.-.#...3l...v..<..gx '.Y.-.|.........Iw.`07\.iwG..~.(...U...0`cA..Gz..rE.6|d.o....).@..9...+..k..........U..z,.J(.pZ.Z..u$hm.9...=.<tc,b....B6..Z.IC....g .<.)t......).........^.c.z..~.W..NO..'YvN..............#.).........g...x..t...I.O.{5$...`B..h~d...{...U.....,#...;.&....ASw.....,1i..C.F1.r.......W...L}..v..'..B..tJ..A.L........4A..F.D.k..s.E..G..Dy..4.~.Y..=...10..2I.R.T...R..`..3.:X...}G..U..+...#i...|.@..r...\4q..M..

                                                                        C:\Users\user\Documents\SFPUSAFIOL\PIVFAGEAAV.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8517077121527175
                                                                        Encrypted:false
                                                                        SSDEEP:24:HTgBkLHnU88jvPvNX5ASc9o5lXeCDdJbvXpI2Y7oJzXUpWauhaIAsUWbD:H8k7nJQ/YSc9o5lX5zPpI2JzEpW/VD
                                                                        MD5:4D9486D99315BD57625B839DD99AD6C4
                                                                        SHA1:19947BA6D7E285C4B0FC2B413DA187BEAA456732
                                                                        SHA-256:782FDB9CF2E7C13D9BFB30D94F3BE5C26092BC2C5C0E7DCAC47C7B1028E2226A
                                                                        SHA-512:82F603C149F2A830EF2344A67EEFC50E3CBB3D911AB9B0044913054ABDCB72814F5E1C8734954E7856688E8E1F4909F93413BA61E82B66DB0FDACEFB68D83940
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.-......+a...n3p.?.>D..[...I....q...._.O.P.dE!...-.]..~.:..o.QLS..(.....N..<KZ}.+.a.^myCD.m....3...@.]1.a....A~....M.s.#...ff.>[...2w.}6@....0|.+.,b..G.Q.......W..T.QO.;g....`.X.}.f.DZ#. .........'...$..w+.I...D.c...[v.>..K@.z..Y..w+c..6.T.....*q....3lM...U.S..h...(Z.C..Q..Br.B.......mU.;}..;;P..J.x...\...~..nA.R..E......)C...........L...{..]p.v..F,..]@....j..q4...........;........\.j....-PM...8p$....S;......&.6b...!zZ.A.....f.S...%v^.W...,..8.....&.fs5....H.^q.?r...3.'.....V..D..*...8|.r.Fvf.HQ..&......8..U.o2p'...^s...o.. E.b...].....YM......[.I....D.....\.B.%./.h.1h....|... .!../..........r....Cu:.9.s..x...(.9.;...c..f.....iu..J|(..D.B.(...... ...Y...&Ni.f.8S..G....V....P....y....0........N.(.M.E.o....i.t.....U=.....t.P....L.....i.#..V .}.<Q.......o.!N...M.;..=..2..jn].>.....)..n.......=z<......}m.......""=.9q....O.>...r6...Z...#..)t]bN.Y|......!Q..0t...##b..b@nP..j.....$.w.........M..N..........N.l.c....

                                                                        C:\Users\user\Documents\SFPUSAFIOL\PIVFAGEAAV.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8517077121527175
                                                                        Encrypted:false
                                                                        SSDEEP:24:HTgBkLHnU88jvPvNX5ASc9o5lXeCDdJbvXpI2Y7oJzXUpWauhaIAsUWbD:H8k7nJQ/YSc9o5lX5zPpI2JzEpW/VD
                                                                        MD5:4D9486D99315BD57625B839DD99AD6C4
                                                                        SHA1:19947BA6D7E285C4B0FC2B413DA187BEAA456732
                                                                        SHA-256:782FDB9CF2E7C13D9BFB30D94F3BE5C26092BC2C5C0E7DCAC47C7B1028E2226A
                                                                        SHA-512:82F603C149F2A830EF2344A67EEFC50E3CBB3D911AB9B0044913054ABDCB72814F5E1C8734954E7856688E8E1F4909F93413BA61E82B66DB0FDACEFB68D83940
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.-......+a...n3p.?.>D..[...I....q...._.O.P.dE!...-.]..~.:..o.QLS..(.....N..<KZ}.+.a.^myCD.m....3...@.]1.a....A~....M.s.#...ff.>[...2w.}6@....0|.+.,b..G.Q.......W..T.QO.;g....`.X.}.f.DZ#. .........'...$..w+.I...D.c...[v.>..K@.z..Y..w+c..6.T.....*q....3lM...U.S..h...(Z.C..Q..Br.B.......mU.;}..;;P..J.x...\...~..nA.R..E......)C...........L...{..]p.v..F,..]@....j..q4...........;........\.j....-PM...8p$....S;......&.6b...!zZ.A.....f.S...%v^.W...,..8.....&.fs5....H.^q.?r...3.'.....V..D..*...8|.r.Fvf.HQ..&......8..U.o2p'...^s...o.. E.b...].....YM......[.I....D.....\.B.%./.h.1h....|... .!../..........r....Cu:.9.s..x...(.9.;...c..f.....iu..J|(..D.B.(...... ...Y...&Ni.f.8S..G....V....P....y....0........N.(.M.E.o....i.t.....U=.....t.P....L.....i.#..V .}.<Q.......o.!N...M.;..=..2..jn].>.....)..n.......=z<......}m.......""=.9q....O.>...r6...Z...#..)t]bN.Y|......!Q..0t...##b..b@nP..j.....$.w.........M..N..........N.l.c....

                                                                        C:\Users\user\Documents\SFPUSAFIOL\PWCCAWLGRE.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85672863272063
                                                                        Encrypted:false
                                                                        SSDEEP:24:OfbENc+evINnRxJARFh7wPvEnGQKP7/RRRHubVAjEiavkol5sHscJWbD:CbEG+evERxqFVn/UJWn98pHs1D
                                                                        MD5:F722BE4AB9408A5BDC548198ABB1E714
                                                                        SHA1:B7356AF2236DB6C5B7C6E37FC7AFE789D4570698
                                                                        SHA-256:65D441601A499695CE07E28423DABCC4787B40678E93F84EF20FF47EF25D4654
                                                                        SHA-512:A5A3F1AC34AB46CE5CEC085C7EA65E462167F0D9F12961AAAF715CAA8A09C92B47148A94DAA7F7A342CB26062A7DB1BDF305C145D9872898A0E1C84B076145FB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA.S.(...R+yo.cNr.l.Q.^.....S..H...I.5..L.5s....i....t...>.^...-.Bl.K...;.&.)...... ...T...p..C.",.r.s!x~....:....j.......Yvn..=,.q"..O...o...b..z4..|..g...Fg.:.................(......y..K..=..&.MH#h..i}.Y ...............5.S!.Y.....jP.B.t.}...M6i........g..............&>...;.).&:.M.....uN..C~..M..+.]..e..[K....a|.*....@...O..I...J0.h.......@....q{1..cs.X.t.........Y.K ..?.; .;...1...Z.T.*.%.?~.fY...+.+.:W..rU.../S..0F......4. ..DH5*(.IRo.....`.%.......ND.w...\]....5.D...!.t.p!U.L&..0NV..Oe...~V.%.^....QQ2..&...o~...!.P:......)......Rc.."..xs:B....!..-5.{..r...=.s.+..........t.6x....>ZD\..8A..Yz.Y.7.o\....!....=5..8.!..Ix...8sFQ..A.}.=.2..s....K7GJ.......{..K...Xk/.....3...m|V..~........V?..r.?........L..._.*e...u|}.?)..C$....T+oZ...-...1R..JY..~..L....ef...^OI+bn7.3&....u....W.N"...._../..x}d..t.<.*.......;d......`..x.)....U...kVv..-#.Z.`..d..0T.:#...H........U.zn]..g.m2<U{.3.r...,.0V.........de|CS.......h.............c#....g&

                                                                        C:\Users\user\Documents\SFPUSAFIOL\PWCCAWLGRE.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85672863272063
                                                                        Encrypted:false
                                                                        SSDEEP:24:OfbENc+evINnRxJARFh7wPvEnGQKP7/RRRHubVAjEiavkol5sHscJWbD:CbEG+evERxqFVn/UJWn98pHs1D
                                                                        MD5:F722BE4AB9408A5BDC548198ABB1E714
                                                                        SHA1:B7356AF2236DB6C5B7C6E37FC7AFE789D4570698
                                                                        SHA-256:65D441601A499695CE07E28423DABCC4787B40678E93F84EF20FF47EF25D4654
                                                                        SHA-512:A5A3F1AC34AB46CE5CEC085C7EA65E462167F0D9F12961AAAF715CAA8A09C92B47148A94DAA7F7A342CB26062A7DB1BDF305C145D9872898A0E1C84B076145FB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA.S.(...R+yo.cNr.l.Q.^.....S..H...I.5..L.5s....i....t...>.^...-.Bl.K...;.&.)...... ...T...p..C.",.r.s!x~....:....j.......Yvn..=,.q"..O...o...b..z4..|..g...Fg.:.................(......y..K..=..&.MH#h..i}.Y ...............5.S!.Y.....jP.B.t.}...M6i........g..............&>...;.).&:.M.....uN..C~..M..+.]..e..[K....a|.*....@...O..I...J0.h.......@....q{1..cs.X.t.........Y.K ..?.; .;...1...Z.T.*.%.?~.fY...+.+.:W..rU.../S..0F......4. ..DH5*(.IRo.....`.%.......ND.w...\]....5.D...!.t.p!U.L&..0NV..Oe...~V.%.^....QQ2..&...o~...!.P:......)......Rc.."..xs:B....!..-5.{..r...=.s.+..........t.6x....>ZD\..8A..Yz.Y.7.o\....!....=5..8.!..Ix...8sFQ..A.}.=.2..s....K7GJ.......{..K...Xk/.....3...m|V..~........V?..r.?........L..._.*e...u|}.?)..C$....T+oZ...-...1R..JY..~..L....ef...^OI+bn7.3&....u....W.N"...._../..x}d..t.<.*.......;d......`..x.)....U...kVv..-#.Z.`..d..0T.:#...H........U.zn]..g.m2<U{.3.r...,.0V.........de|CS.......h.............c#....g&

                                                                        C:\Users\user\Documents\SFPUSAFIOL\QNCYCDFIJJ.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859303329245461
                                                                        Encrypted:false
                                                                        SSDEEP:24:hhPgobkIVNRSr1hmrINAFgQTIT7LFRwTQA0QuP/JMX3CVIFJSbLV8KnqTS2JCFeq:hpBGHmrIOFgQTsPM0QuHM8ITSakES2JO
                                                                        MD5:401525384AF4849AACEFD99F81C32073
                                                                        SHA1:04AEBC9EE90DF80FAEDAAEB379061987667C6619
                                                                        SHA-256:F411170408CB03F76ACF1D0084F130A6D46E097872BF5E4CE563EF4039BD7134
                                                                        SHA-512:9D2812C45CF3AB8559A5477651EB3144ABC06975DA4C71315CC683A366010565ECD42C7132277F8F670A43BA74DF0614E340F7AA54D26C6A2F99ED769F561839
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC........Vh.)_...t.&%u.x3..mgT&W.H....4e.R.W...^..Q..`V....u....z.....E.'..-?&;O........[...[....l...,fJ.xu.v...h.v...}.A.<.wv.s l=.*.... 2._.'..C.&4..1h.i%.6.&@....")..i..].|.....@.9B.<....R..p3.;...P...b}r...f...sH...(..!o~..bV..Y.J;.\.].".Mq.C....Gy..C.d."........Z.*...,.....W...........,.....+..o5l.v..q..|.........O....h.1Z<I'..p..N..w...:`.O.....g...F....mg7,........'P?xR.*.Pj........s.1.&...{s..T.....0.{.2...Q.b..'._7.8#.C....^.}...M?.T.X.=...=zHi..N^(.......:@..D. ....._.;&.....Bi4..c..D......s.a.......x...-.h....X../...d.*.Gl..7u....,?HAD.W.....M.P.s7.;...Ii....e.._.3.T...o.....G.?T@./....u.Q..~.>...|...-.zAFv.5A9....Q..............N..........e..'Xm_....,...#...@.e.Y./..(7!"..0[..*.f....`0=...m''.d.a.4..c.r...+9../[...*|[.....D....9d...L.J..Z.....1..@.....\...@32BBn/m..c;.X.VV.:.-..i..i....Q?........$8br.......j...`....cM.b.v..%Wl.s.b...u...!..B7.......2...."..S..w..+.uD.&....S:.pq.#...v-./.+.u.......w.....C]

                                                                        C:\Users\user\Documents\SFPUSAFIOL\QNCYCDFIJJ.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859303329245461
                                                                        Encrypted:false
                                                                        SSDEEP:24:hhPgobkIVNRSr1hmrINAFgQTIT7LFRwTQA0QuP/JMX3CVIFJSbLV8KnqTS2JCFeq:hpBGHmrIOFgQTsPM0QuHM8ITSakES2JO
                                                                        MD5:401525384AF4849AACEFD99F81C32073
                                                                        SHA1:04AEBC9EE90DF80FAEDAAEB379061987667C6619
                                                                        SHA-256:F411170408CB03F76ACF1D0084F130A6D46E097872BF5E4CE563EF4039BD7134
                                                                        SHA-512:9D2812C45CF3AB8559A5477651EB3144ABC06975DA4C71315CC683A366010565ECD42C7132277F8F670A43BA74DF0614E340F7AA54D26C6A2F99ED769F561839
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC........Vh.)_...t.&%u.x3..mgT&W.H....4e.R.W...^..Q..`V....u....z.....E.'..-?&;O........[...[....l...,fJ.xu.v...h.v...}.A.<.wv.s l=.*.... 2._.'..C.&4..1h.i%.6.&@....")..i..].|.....@.9B.<....R..p3.;...P...b}r...f...sH...(..!o~..bV..Y.J;.\.].".Mq.C....Gy..C.d."........Z.*...,.....W...........,.....+..o5l.v..q..|.........O....h.1Z<I'..p..N..w...:`.O.....g...F....mg7,........'P?xR.*.Pj........s.1.&...{s..T.....0.{.2...Q.b..'._7.8#.C....^.}...M?.T.X.=...=zHi..N^(.......:@..D. ....._.;&.....Bi4..c..D......s.a.......x...-.h....X../...d.*.Gl..7u....,?HAD.W.....M.P.s7.;...Ii....e.._.3.T...o.....G.?T@./....u.Q..~.>...|...-.zAFv.5A9....Q..............N..........e..'Xm_....,...#...@.e.Y./..(7!"..0[..*.f....`0=...m''.d.a.4..c.r...+9../[...*|[.....D....9d...L.J..Z.....1..@.....\...@32BBn/m..c;.X.VV.:.-..i..i....Q?........$8br.......j...`....cM.b.v..%Wl.s.b...u...!..B7.......2...."..S..w..+.uD.&....S:.pq.#...v-./.+.u.......w.....C]

                                                                        C:\Users\user\Documents\SFPUSAFIOL\SFPUSAFIOL.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85459501122221
                                                                        Encrypted:false
                                                                        SSDEEP:24:9mAr15yrm1vE+gYm/hCTK33qYfKFah+5rAV06II5Uwh5s82ynthUfmpYrgPWbD:EAr15yrm1vE+XmsTK3JfKFaM5re06II8
                                                                        MD5:F9618F9D6D41E0B6579D89E0C033527F
                                                                        SHA1:7D81EC90025520654C6572C988CD33C78A51DD40
                                                                        SHA-256:2D545B3F4FFB10CC95052D12AEBE60EC116A775522D3926A1412E49CC2381FE5
                                                                        SHA-512:0E3D66119356FF16E053CE1A7D08950147F3A707EB8FDB417F6CA18275F32CB8CCB184857A1CA24574EF119F40DA4BAFD1C85E1FCB5C9453AF0863B8EDA581D3
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUSG.......e._....i.X.G.Eo...\....6@......G..@^~i...K..,f ......Lm.4G....N_.P..b.....G>.t....:7.G.....4..8>....&S...Gdw..%M0.h.z.k4...HWz.#.B.....;.3\.G.w*....C,8N..5..... .Inw*..RY...._.....1.C....Q..B;3..-.v`.]..f..#c...N.._l ....m......u..m.7|..X.I./....||g......*7_6]p....s.v.....4.j..h.yl&..i<UrPV8.1mc(....+.K^.y.....}z..c..$.I..@E e......3...W.L.}..&..K......)D...r...N..g....#V.p.+U..l.Wq.a....q.V....Sp..K`......D..z.!l..7.<..]a.W..9. ..J....e[..>v.D.@..0.o`.O.Y._**.....tY..Z..=..F.....V...%..{.MhP..1...b.c.=..Ej .'Mi..(...M.......t...9...\M....#..9...o.......a.Z.].....M.....1&.=......q.AuoA..i{.7..~B.....,-..E......a...R.......%...L...._.......^N.8m........~.d...l...R.1.(n.b..z.*.nS.x..B........y ...A..7+..]m.E...,...}A...9i....\..R;`wR.^..F..x|...Jx......E.`..w.8;...QR.._1X....t.O.....'Ak.3kx.j.......^..<..(....L...'...5.P.....w.~.,H..kW.....`-.XH...5..x.U.C.....M.....L.(.c.X.+m.*.#...%e.....u.H......M&...2.L.&Y./.V.=.v.n..w.

                                                                        C:\Users\user\Documents\SFPUSAFIOL\SFPUSAFIOL.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.85459501122221
                                                                        Encrypted:false
                                                                        SSDEEP:24:9mAr15yrm1vE+gYm/hCTK33qYfKFah+5rAV06II5Uwh5s82ynthUfmpYrgPWbD:EAr15yrm1vE+XmsTK3JfKFaM5re06II8
                                                                        MD5:F9618F9D6D41E0B6579D89E0C033527F
                                                                        SHA1:7D81EC90025520654C6572C988CD33C78A51DD40
                                                                        SHA-256:2D545B3F4FFB10CC95052D12AEBE60EC116A775522D3926A1412E49CC2381FE5
                                                                        SHA-512:0E3D66119356FF16E053CE1A7D08950147F3A707EB8FDB417F6CA18275F32CB8CCB184857A1CA24574EF119F40DA4BAFD1C85E1FCB5C9453AF0863B8EDA581D3
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUSG.......e._....i.X.G.Eo...\....6@......G..@^~i...K..,f ......Lm.4G....N_.P..b.....G>.t....:7.G.....4..8>....&S...Gdw..%M0.h.z.k4...HWz.#.B.....;.3\.G.w*....C,8N..5..... .Inw*..RY...._.....1.C....Q..B;3..-.v`.]..f..#c...N.._l ....m......u..m.7|..X.I./....||g......*7_6]p....s.v.....4.j..h.yl&..i<UrPV8.1mc(....+.K^.y.....}z..c..$.I..@E e......3...W.L.}..&..K......)D...r...N..g....#V.p.+U..l.Wq.a....q.V....Sp..K`......D..z.!l..7.<..]a.W..9. ..J....e[..>v.D.@..0.o`.O.Y._**.....tY..Z..=..F.....V...%..{.MhP..1...b.c.=..Ej .'Mi..(...M.......t...9...\M....#..9...o.......a.Z.].....M.....1&.=......q.AuoA..i{.7..~B.....,-..E......a...R.......%...L...._.......^N.8m........~.d...l...R.1.(n.b..z.*.nS.x..B........y ...A..7+..]m.E...,...}A...9i....\..R;`wR.^..F..x|...Jx......E.`..w.8;...QR.._1X....t.O.....'Ak.3kx.j.......^..<..(....L...'...5.P.....w.~.,H..kW.....`-.XH...5..x.U.C.....M.....L.(.c.X.+m.*.#...%e.....u.H......M&...2.L.&Y./.V.=.v.n..w.

                                                                        C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8691713745480785
                                                                        Encrypted:false
                                                                        SSDEEP:24:TWCPN87ipKaaySiA1Xpwx9qOxj17FmXZUAKdt+896Q+ZfnMRLsnHKkWbD:TWCPNwWaPiARpwx9qOt17G27+8AJnMRF
                                                                        MD5:308D3F6DFB7984D662F71F1662570CEB
                                                                        SHA1:B09143CD4C0AB69D2BE79C5747F1CDC49970BDA2
                                                                        SHA-256:2CD0D47F54380ED2C4529A9D1DDE15F7440C9146989C27C17698DC55DBBC284D
                                                                        SHA-512:AB8E40D51197C1B88602372B2D06B981D555A7188C71E070EBBAD0BCB652B4E5100AA400A1B0EF0002E6191D60C8D474C2F1D23E1A10DAD105259D5CBF512154
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.w]K..v.^..q...k..s.....IL.;..u%g..W..|......4]..>E....+.ph.../E...v..CE.........7..*..z. ....D.IF.0<y.r.)=....z.<@.w........>U....`9.^2v.N....=T...L_{@^.q.<.[$^!8U....:X.....q..5.\}F.;.b=].+.....Jq..}.........c.i..J.ql.\..?..R}.2....(MQ..\1........A......2....\..W.[...$,h.q...k../..-T...^O:.R;).=..D...f.PG.............{..F.s..G.G.U=.~.d.]....O.19w........h...."....wD...)Mf...1...Jw.s...x(....>..E"..C.:_....D.Vs....._....%d....X.;. ....s...1...0../T....2....2..*...m.=:.|..9.......3..L E..`_..a..N.,.n.....,C7.1.$.3..../\.e..].....(.J...=.pF...j....."...A..PL^...;..DI Y....=..E.l"....CuWi.P$..;G.W...#?N1hU....-..H...E....hVccJ~.p....Y.....o..Q....&.d..@[k>..v.t......A.>RQ..Ng.Z..$?.u5...;&a.B..q.....=....v....C.*..!2....^Q|.....o..m{B5..a..Q..5.q...X.+Xn..V...VD&$..O....A0...q...%...S..}c../.4`.Zu_.r.X.u.d.KRW...Y.xK.z.....=..?.u....Z.|.....w`...i....Z.HKsM.....[m5.w2..H.R:P.b".i..B.i.5?......J5...@... q......x.EGb`6.&.

                                                                        C:\Users\user\Documents\SFPUSAFIOL\ZQIXMVQGAH.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8691713745480785
                                                                        Encrypted:false
                                                                        SSDEEP:24:TWCPN87ipKaaySiA1Xpwx9qOxj17FmXZUAKdt+896Q+ZfnMRLsnHKkWbD:TWCPNwWaPiARpwx9qOt17G27+8AJnMRF
                                                                        MD5:308D3F6DFB7984D662F71F1662570CEB
                                                                        SHA1:B09143CD4C0AB69D2BE79C5747F1CDC49970BDA2
                                                                        SHA-256:2CD0D47F54380ED2C4529A9D1DDE15F7440C9146989C27C17698DC55DBBC284D
                                                                        SHA-512:AB8E40D51197C1B88602372B2D06B981D555A7188C71E070EBBAD0BCB652B4E5100AA400A1B0EF0002E6191D60C8D474C2F1D23E1A10DAD105259D5CBF512154
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM.w]K..v.^..q...k..s.....IL.;..u%g..W..|......4]..>E....+.ph.../E...v..CE.........7..*..z. ....D.IF.0<y.r.)=....z.<@.w........>U....`9.^2v.N....=T...L_{@^.q.<.[$^!8U....:X.....q..5.\}F.;.b=].+.....Jq..}.........c.i..J.ql.\..?..R}.2....(MQ..\1........A......2....\..W.[...$,h.q...k../..-T...^O:.R;).=..D...f.PG.............{..F.s..G.G.U=.~.d.]....O.19w........h...."....wD...)Mf...1...Jw.s...x(....>..E"..C.:_....D.Vs....._....%d....X.;. ....s...1...0../T....2....2..*...m.=:.|..9.......3..L E..`_..a..N.,.n.....,C7.1.$.3..../\.e..].....(.J...=.pF...j....."...A..PL^...;..DI Y....=..E.l"....CuWi.P$..;G.W...#?N1hU....-..H...E....hVccJ~.p....Y.....o..Q....&.d..@[k>..v.t......A.>RQ..Ng.Z..$?.u5...;&a.B..q.....=....v....C.*..!2....^Q|.....o..m{B5..a..Q..5.q...X.+Xn..V...VD&$..O....A0...q...%...S..}c../.4`.Zu_.r.X.u.d.KRW...Y.xK.z.....=..?.u....Z.|.....w`...i....Z.HKsM.....[m5.w2..H.R:P.b".i..B.i.5?......J5...@... q......x.EGb`6.&.

                                                                        C:\Users\user\Documents\ZQIXMVQGAH.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.840400190005755
                                                                        Encrypted:false
                                                                        SSDEEP:24:KPmvQETYQlNqcYPHrUX4SfYi2YurUG4z9PjhLqNPTYsbA3g3WVo6JlzGS2mrVtGM:nbB4zW4YYi2YI8gPTaeklx2QD
                                                                        MD5:7171252AE2CAE275E931A459B014DD36
                                                                        SHA1:887E643A6093200E3FB52486ED295FA26F142421
                                                                        SHA-256:D1B3A80594FD5F53C0DB5C1D23E865E39BDFF7FF196A47F8B039A2ECA03E6761
                                                                        SHA-512:21D2C4737766D0AAF5563BFCD362BE9DE33BDBB762586B7103AFD76A91407DA8FC03592A3E96F2C96EE0A88930F87BBDEAA18501560B8DF0A511D8D4ED7E2C96
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMg.W.....bF..Q...*.pe.2qj.$g..8;.......e..u.W!l}f^1..I..O.i.>.f...+8c&/.;.., +.V/.H..f."..E.:.F@.....^...w.a.V.m.}...=...,.k..N..q:>D..iNN.%...,..%..StN..y..>*.d...D....'.DF...3.RY..h.!..co.....v.0.32Ko/..3...L..A...%3ZL.v?..I;';O...M... -.......T@.....\?).p......4..t..+.7K...z;.WZ..........{.S...$....(.uZ.s......$f*b.R...?.....U.@.... j.h..&..n...LB....._B.J..... .._....8Y#}.zqH......uf.UR..SL}'..!....]y@n_.d...;..J3x3..x.};}..GB.........N...RX.. ,.v].\. f.V.D..P..D...K......I..9....w..!.b...'.VRu.<IK.M...r.'..<.:*5..<.|.C.C.GkA...+........>....|....$.S...:..6.p.hhA..".....-.o..q.........?\}..9,YR.q.w.....E.M.&.Y#....fW.._.L...V9.ye......).._.Y.w...zUa...M.I..n.1uX>q...&..$u.....*.............d...*.>..J...I.).....E;.?....(*....J.+..........G2._..I.X*f.l.5bu8....]S......l....9.~......Ru.&.Y.d.]0/w@.f3..n.TH%L.T..a..[Q..g..O..g>..w.!t].G>...G(..L..[".[...@F...QJCR.?.|.#............s..>.5].........4QR.6...R.;.......ge..r....Iwl..

                                                                        C:\Users\user\Documents\ZQIXMVQGAH.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.840400190005755
                                                                        Encrypted:false
                                                                        SSDEEP:24:KPmvQETYQlNqcYPHrUX4SfYi2YurUG4z9PjhLqNPTYsbA3g3WVo6JlzGS2mrVtGM:nbB4zW4YYi2YI8gPTaeklx2QD
                                                                        MD5:7171252AE2CAE275E931A459B014DD36
                                                                        SHA1:887E643A6093200E3FB52486ED295FA26F142421
                                                                        SHA-256:D1B3A80594FD5F53C0DB5C1D23E865E39BDFF7FF196A47F8B039A2ECA03E6761
                                                                        SHA-512:21D2C4737766D0AAF5563BFCD362BE9DE33BDBB762586B7103AFD76A91407DA8FC03592A3E96F2C96EE0A88930F87BBDEAA18501560B8DF0A511D8D4ED7E2C96
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMg.W.....bF..Q...*.pe.2qj.$g..8;.......e..u.W!l}f^1..I..O.i.>.f...+8c&/.;.., +.V/.H..f."..E.:.F@.....^...w.a.V.m.}...=...,.k..N..q:>D..iNN.%...,..%..StN..y..>*.d...D....'.DF...3.RY..h.!..co.....v.0.32Ko/..3...L..A...%3ZL.v?..I;';O...M... -.......T@.....\?).p......4..t..+.7K...z;.WZ..........{.S...$....(.uZ.s......$f*b.R...?.....U.@.... j.h..&..n...LB....._B.J..... .._....8Y#}.zqH......uf.UR..SL}'..!....]y@n_.d...;..J3x3..x.};}..GB.........N...RX.. ,.v].\. f.V.D..P..D...K......I..9....w..!.b...'.VRu.<IK.M...r.'..<.:*5..<.|.C.C.GkA...+........>....|....$.S...:..6.p.hhA..".....-.o..q.........?\}..9,YR.q.w.....E.M.&.Y#....fW.._.L...V9.ye......).._.Y.w...zUa...M.I..n.1uX>q...&..$u.....*.............d...*.>..J...I.).....E;.?....(*....J.+..........G2._..I.X*f.l.5bu8....]S......l....9.~......Ru.&.Y.d.]0/w@.f3..n.TH%L.T..a..[Q..g..O..g>..w.!t].G>...G(..L..[".[...@F...QJCR.?.|.#............s..>.5].........4QR.6...R.;.......ge..r....Iwl..

                                                                        C:\Users\user\Documents\ZQIXMVQGAH.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.851583638209215
                                                                        Encrypted:false
                                                                        SSDEEP:24:kpOytmuxD/zGYGtXz5jbzbd7WiXqQLk36PoUPxJSLOWbD:TQxD/NGtXz5zbd7WOk36ta3D
                                                                        MD5:BA7FA10D14368E40D797BC2E08079BD6
                                                                        SHA1:436A59B5FBD3F559281F6FDB3DB81FE8530FE477
                                                                        SHA-256:C4C9DD9A46553486B75475E8830024D28CE6DDAF9BD7BA8C29E9E14FD27D1260
                                                                        SHA-512:7F9F347A609ED7DBCA7B00629824C9D57ABF53999B56C5781380F843B0C50D4C6F6035765BC9B6A290CE54129F97FC0CCB86DE47DD85C1631C1BE2DDDB667577
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM..C.6+.7.<9...1....y.!Yz.E..K...~\.os.=*wb-..N......k.c..qB9O...4...3=.Ej.Ct.2T..Kh.G.;....~.........^....(.P08..|.W.....4.>.y,S4..1.....2....90D.....a.$]....k..=.jG.T...asak.e.v.k.....}...^..w.i.#|.A.}./o....y..R=CF.@|Q)......\.@i..u.j...b{.p(."%{../."... .....PQYGo&..X..rp.N.{..@.e.=..W&M.St.f..!.,........n\%s).,.XA... .......;..Lc@.'.A.v..{+..C...7.r..ya.o.*F.@I`.V.......+5........K..e....z7....N.7.8..4....DZ..8.;...".Ca.(J......s....T..m...s.s./..~ ..........0i,.M.An.#f.\......V.tom..>W...........2Y.J..`v.P.s..\.c...To........;......&.....b1....~..".a7......Rb........E...?.1..4..{...\......w....w55..nq$....;.@....u........A:D88........8.<fx.o...'.o....%kG.a..[%.....b..\k..q)..Q.......}...Q..c.1.#.kK.Xa.=.....(.%a.6F..X...p..B..>.?.#xrJ........O.+G.....j.I...Jq... ..........J.5U?[.\%.!.8..z...1+.......?+.q..v|.w...,....."..'...k.o.....K..._..........fJ.>i.....f(..[...@.r"<E..w.B..+..._.A..g.51..:..Y...R..7.r.Q.X....?G._zi..O.f.(.1

                                                                        C:\Users\user\Documents\ZQIXMVQGAH.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.851583638209215
                                                                        Encrypted:false
                                                                        SSDEEP:24:kpOytmuxD/zGYGtXz5jbzbd7WiXqQLk36PoUPxJSLOWbD:TQxD/NGtXz5zbd7WOk36ta3D
                                                                        MD5:BA7FA10D14368E40D797BC2E08079BD6
                                                                        SHA1:436A59B5FBD3F559281F6FDB3DB81FE8530FE477
                                                                        SHA-256:C4C9DD9A46553486B75475E8830024D28CE6DDAF9BD7BA8C29E9E14FD27D1260
                                                                        SHA-512:7F9F347A609ED7DBCA7B00629824C9D57ABF53999B56C5781380F843B0C50D4C6F6035765BC9B6A290CE54129F97FC0CCB86DE47DD85C1631C1BE2DDDB667577
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM..C.6+.7.<9...1....y.!Yz.E..K...~\.os.=*wb-..N......k.c..qB9O...4...3=.Ej.Ct.2T..Kh.G.;....~.........^....(.P08..|.W.....4.>.y,S4..1.....2....90D.....a.$]....k..=.jG.T...asak.e.v.k.....}...^..w.i.#|.A.}./o....y..R=CF.@|Q)......\.@i..u.j...b{.p(."%{../."... .....PQYGo&..X..rp.N.{..@.e.=..W&M.St.f..!.,........n\%s).,.XA... .......;..Lc@.'.A.v..{+..C...7.r..ya.o.*F.@I`.V.......+5........K..e....z7....N.7.8..4....DZ..8.;...".Ca.(J......s....T..m...s.s./..~ ..........0i,.M.An.#f.\......V.tom..>W...........2Y.J..`v.P.s..\.c...To........;......&.....b1....~..".a7......Rb........E...?.1..4..{...\......w....w55..nq$....;.@....u........A:D88........8.<fx.o...'.o....%kG.a..[%.....b..\k..q)..Q.......}...Q..c.1.#.kK.Xa.=.....(.%a.6F..X...p..B..>.?.#xrJ........O.+G.....j.I...Jq... ..........J.5U?[.\%.!.8..z...1+.......?+.q..v|.w...,....."..'...k.o.....K..._..........fJ.>i.....f(..[...@.r"<E..w.B..+..._.A..g.51..:..Y...R..7.r.Q.X....?G._zi..O.f.(.1

                                                                        C:\Users\user\Documents\ZQIXMVQGAH.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.86261609809385
                                                                        Encrypted:false
                                                                        SSDEEP:24:8IVc/5aMUho1tj9dXggRUT5dEtkUNwPeCOGx/vbNCRnaD51OZevMNKQWbD:8IuBaMy8tnXgyUTPaXCR/vbNCRnmq8vb
                                                                        MD5:0EB01054963ABC16B2039DBD6C42741E
                                                                        SHA1:86E5AC14911678C39A85B06F919EF9851BD7A01E
                                                                        SHA-256:75610D5A135899D5130CB3C41D86A93B37A500262FAADE96FCE06DBB4D691E37
                                                                        SHA-512:4842569B386AFEE52D72BFBFA98DD2B7BB9D94348C519741A7C620583212E46C059519B0AD83AD4F84D6C06126DBDC4D034B736DAF6A2A656148B4C54CC8C49D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM"..m.}......R....3....h&.R..)..E...H>-.-..h;1..]...u..YI..._@.C".A.o.)/,..5.(......<0.<.r..h2.ex"Z...=.).JF. ...DU..xZ.8.........+.......Uk.f>...b....hg....I..3.....*..q..n...S.S.........[."....\X?.Z...jl[W.....x*..E.bk.n..h....&.c*.._.h.K....q......G........-.V............oe...5...3wL[\.j.....>..*,.X.........A.V..R.8..z..7.&....1."...$9.D..(.=1.....$.u9..../,.`......:l.:h..\H.j.=.....I.aI....{%.....O...:i-.(~.U....D....].......4.]8.j.."..z.w. '..UZ..^..>+..qq.~........^q......t.F%......x.y.x7\;z$.............q_".9.NI.i..b-......3z0..4...t./OE+....e;&O.... p)...\....oIk.,..7.:gTK.7.p...CH.o..S..J.l.+..r....f.[..H..wJ[....3...`g0.f.3ZE&u.+L...Z....B}LT"......r......J...%$Q...%..Y&aS.S.g*....n..@.5.N......).K.JE...........8...D....z..g..#e....yXAD..7w.C.3y..Q.n......uz.U.O......_.Y!y0{!..Zs.A...R......N.G.!H.41.-..!..Y._..FH......q.j..?.4.....W.g.........U...6...j....|..[.`X.d.m.AH.....8[c%z.Qc..;.Qnv.......$..........,q8.......y(....e..

                                                                        C:\Users\user\Documents\ZQIXMVQGAH.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.86261609809385
                                                                        Encrypted:false
                                                                        SSDEEP:24:8IVc/5aMUho1tj9dXggRUT5dEtkUNwPeCOGx/vbNCRnaD51OZevMNKQWbD:8IuBaMy8tnXgyUTPaXCR/vbNCRnmq8vb
                                                                        MD5:0EB01054963ABC16B2039DBD6C42741E
                                                                        SHA1:86E5AC14911678C39A85B06F919EF9851BD7A01E
                                                                        SHA-256:75610D5A135899D5130CB3C41D86A93B37A500262FAADE96FCE06DBB4D691E37
                                                                        SHA-512:4842569B386AFEE52D72BFBFA98DD2B7BB9D94348C519741A7C620583212E46C059519B0AD83AD4F84D6C06126DBDC4D034B736DAF6A2A656148B4C54CC8C49D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM"..m.}......R....3....h&.R..)..E...H>-.-..h;1..]...u..YI..._@.C".A.o.)/,..5.(......<0.<.r..h2.ex"Z...=.).JF. ...DU..xZ.8.........+.......Uk.f>...b....hg....I..3.....*..q..n...S.S.........[."....\X?.Z...jl[W.....x*..E.bk.n..h....&.c*.._.h.K....q......G........-.V............oe...5...3wL[\.j.....>..*,.X.........A.V..R.8..z..7.&....1."...$9.D..(.=1.....$.u9..../,.`......:l.:h..\H.j.=.....I.aI....{%.....O...:i-.(~.U....D....].......4.]8.j.."..z.w. '..UZ..^..>+..qq.~........^q......t.F%......x.y.x7\;z$.............q_".9.NI.i..b-......3z0..4...t./OE+....e;&O.... p)...\....oIk.,..7.:gTK.7.p...CH.o..S..J.l.+..r....f.[..H..wJ[....3...`g0.f.3ZE&u.+L...Z....B}LT"......r......J...%$Q...%..Y&aS.S.g*....n..@.5.N......).K.JE...........8...D....z..g..#e....yXAD..7w.C.3y..Q.n......uz.U.O......_.Y!y0{!..Zs.A...R......N.G.!H.41.-..!..Y._..FH......q.j..?.4.....W.g.........U...6...j....|..[.`X.d.m.AH.....8[c%z.Qc..;.Qnv.......$..........,q8.......y(....e..

                                                                        C:\Users\user\Downloads\EEGWXUHVUG.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.823250967682711
                                                                        Encrypted:false
                                                                        SSDEEP:24:jGfsGQNT7Kboq/mju1F3nPG9Dypm8gm9dLA6qNsjdSb5vT5vTIgWbD:jKrQN/Auju1FQGpHg4BQNsjI9TdEVD
                                                                        MD5:4D7BADE484B3DF58702BBB7B30F3C05F
                                                                        SHA1:117EB4732A159B22B22D8AD795A4E1604850B835
                                                                        SHA-256:4900B85AF09B489B8CF96C9081769C493191E25B44A8000A9CE1546E1B7E909B
                                                                        SHA-512:9D14B4E2220E2EFF250DBC80AB8BEEF6423F5C34EBF7801DE41757D43ED5BA09333D209CE6A7F7F22F8EB333F9320D41645F0A2B59E6FEC44ED63371852C6BC0
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWX...n.B...ox.b.f...."...I).G.`.kg....a......U..`...O..B..(..Ps.i.m.t......[..;Vf..<.....c......X.U....s.....1...\.M.(.#.%.S......C...%...k.-..O......1....S^..*w$.2...... ..k..H.Nb.. ]AG........bR.\e.....!).nPX.Y;...=?.S.O"./.S.$..j.s..C...|....'....'...w.u..3....."..d6>..!..F.[...-~.kw...}...Xw.'F.E..P.\..zk^6..$.<......N.......b{....G3X...;l>..y.....D~{R.O.....A..S.\..DY.U..e.k...j1......JD+.o.3.......[.......9(.C...*~.<...q..N.P..y\U.....]q..B..I.Cx.........I+#.....' s9..Pfr......q.m...@B....=.y7...^..X6.F.?Q..3.,..h#..r7..?K....H.Q.t....V.x.....P.R.......P..RZ.bv....<P.....@.u.._jP.##..i.Z....`..b....f..#.....N....ub.zAg.W.8E3:..uv.....P\w[JYAtO'.F.N.Fo...3u.+..J./m=.&.h[..C|...,6...j...'...Pj.i..0.....,h....Q.P=:....s.t....';)O......u.u...z...9....}.y.p...;.nk...,....X...R...w..m~.U.O.)n.;.wX.f.............>H8.i.q..me..A..........>/..c...f..b'.@.nl9k.m.!...Azs.....C......I%....Z..R..8....w...u.Og..C.&*...Ea.{.a%..G.K.............P

                                                                        C:\Users\user\Downloads\EEGWXUHVUG.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.823250967682711
                                                                        Encrypted:false
                                                                        SSDEEP:24:jGfsGQNT7Kboq/mju1F3nPG9Dypm8gm9dLA6qNsjdSb5vT5vTIgWbD:jKrQN/Auju1FQGpHg4BQNsjI9TdEVD
                                                                        MD5:4D7BADE484B3DF58702BBB7B30F3C05F
                                                                        SHA1:117EB4732A159B22B22D8AD795A4E1604850B835
                                                                        SHA-256:4900B85AF09B489B8CF96C9081769C493191E25B44A8000A9CE1546E1B7E909B
                                                                        SHA-512:9D14B4E2220E2EFF250DBC80AB8BEEF6423F5C34EBF7801DE41757D43ED5BA09333D209CE6A7F7F22F8EB333F9320D41645F0A2B59E6FEC44ED63371852C6BC0
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:EEGWX...n.B...ox.b.f...."...I).G.`.kg....a......U..`...O..B..(..Ps.i.m.t......[..;Vf..<.....c......X.U....s.....1...\.M.(.#.%.S......C...%...k.-..O......1....S^..*w$.2...... ..k..H.Nb.. ]AG........bR.\e.....!).nPX.Y;...=?.S.O"./.S.$..j.s..C...|....'....'...w.u..3....."..d6>..!..F.[...-~.kw...}...Xw.'F.E..P.\..zk^6..$.<......N.......b{....G3X...;l>..y.....D~{R.O.....A..S.\..DY.U..e.k...j1......JD+.o.3.......[.......9(.C...*~.<...q..N.P..y\U.....]q..B..I.Cx.........I+#.....' s9..Pfr......q.m...@B....=.y7...^..X6.F.?Q..3.,..h#..r7..?K....H.Q.t....V.x.....P.R.......P..RZ.bv....<P.....@.u.._jP.##..i.Z....`..b....f..#.....N....ub.zAg.W.8E3:..uv.....P\w[JYAtO'.F.N.Fo...3u.+..J./m=.&.h[..C|...,6...j...'...Pj.i..0.....,h....Q.P=:....s.t....';)O......u.u...z...9....}.y.p...;.nk...,....X...R...w..m~.U.O.)n.;.wX.f.............>H8.i.q..me..A..........>/..c...f..b'.@.nl9k.m.!...Azs.....C......I%....Z..R..8....w...u.Og..C.&*...Ea.{.a%..G.K.............P

                                                                        C:\Users\user\Downloads\GRXZDKKVDB.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.839339155284019
                                                                        Encrypted:false
                                                                        SSDEEP:24:Wx39N3JCDZwZeBhWQ8JjrQi9rjVTCbYcMC+pa7cZPceOrNhr4D60Dz5D1fSHxWbD:WRJCDZwZeBhWQS21sbbEzr4D6Q98uD
                                                                        MD5:39DB0A1FCCCC60B214A6DCB3E0D2CB8B
                                                                        SHA1:BFE975C4EA64AC207DE5BA9A45BFD5B47A10F4E7
                                                                        SHA-256:F6A4780ABA0B864E38B29B1FD5120420092B9283F451C6E157208942F5B58095
                                                                        SHA-512:050E0EAAA1999313FE5DBF793532F8D5BFB0700CE20E136F8591712E0F1CEC9C5828933198119C437D0FE1494CD80B19A06F1537D0BBD50F113067E9C831E251
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD..~$....O{.~K....P.l.J...kEe.....Z.O,H.~].zK...~2&Y....'....lv.t...eqx.FF..|.Yx...#s..#..#D.)..+... z.~..3...eU}.....`el`.y..0X...0.H.1..a.5....M..be.PV ....0...2K..y...........G...$..M.....|...0.r.!n.....K^..W..1X.r......9..7......ZP..W{i.9[...=5g....~J:..s....QF..]T.H.sf...Q....p.N....5\%.D{a..../#..8(.H..S"..!.S..z..2.*=.O....X...27i,....{i.i..W~|.0......`4../.k.up...A.e...fF..-:.FI.M....,.s...5..K0...%.@~N2.}...a..n.K_...w|F8.h......v..G../KT...3f}.h...4/.2.F......B.....x...-.ar...;.[_.Y.V.<Fh..`;...N.c....}..Q..J.;.w\=pg.#t.J.r...V1c.h;.X.g..K..8F.{U6#'.2o.......$...v.Ii..k..G..F....v.0&.`.s.|....t..!.......e..9 .f.P?.6.....:..2.1.....`@.CG..5Zm?...O........9../.U..!@N=.0../.g.Kh...`....n..(...e%.N+..d....z .......%..U.&c>a...%.l@.d.2'......-5ED.7.',........h.v.N>Rn....b.c..6..~....W..,h...Z.Xi....4|)..........q..}\*/.jYH..r7..)..Fz..~.S......{..Ar..`(...y..Ik`{.I.)...n...A...E.....B`,:..DCD.~..j....2..@8..WW,..c.

                                                                        C:\Users\user\Downloads\GRXZDKKVDB.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.839339155284019
                                                                        Encrypted:false
                                                                        SSDEEP:24:Wx39N3JCDZwZeBhWQ8JjrQi9rjVTCbYcMC+pa7cZPceOrNhr4D60Dz5D1fSHxWbD:WRJCDZwZeBhWQS21sbbEzr4D6Q98uD
                                                                        MD5:39DB0A1FCCCC60B214A6DCB3E0D2CB8B
                                                                        SHA1:BFE975C4EA64AC207DE5BA9A45BFD5B47A10F4E7
                                                                        SHA-256:F6A4780ABA0B864E38B29B1FD5120420092B9283F451C6E157208942F5B58095
                                                                        SHA-512:050E0EAAA1999313FE5DBF793532F8D5BFB0700CE20E136F8591712E0F1CEC9C5828933198119C437D0FE1494CD80B19A06F1537D0BBD50F113067E9C831E251
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:GRXZD..~$....O{.~K....P.l.J...kEe.....Z.O,H.~].zK...~2&Y....'....lv.t...eqx.FF..|.Yx...#s..#..#D.)..+... z.~..3...eU}.....`el`.y..0X...0.H.1..a.5....M..be.PV ....0...2K..y...........G...$..M.....|...0.r.!n.....K^..W..1X.r......9..7......ZP..W{i.9[...=5g....~J:..s....QF..]T.H.sf...Q....p.N....5\%.D{a..../#..8(.H..S"..!.S..z..2.*=.O....X...27i,....{i.i..W~|.0......`4../.k.up...A.e...fF..-:.FI.M....,.s...5..K0...%.@~N2.}...a..n.K_...w|F8.h......v..G../KT...3f}.h...4/.2.F......B.....x...-.ar...;.[_.Y.V.<Fh..`;...N.c....}..Q..J.;.w\=pg.#t.J.r...V1c.h;.X.g..K..8F.{U6#'.2o.......$...v.Ii..k..G..F....v.0&.`.s.|....t..!.......e..9 .f.P?.6.....:..2.1.....`@.CG..5Zm?...O........9../.U..!@N=.0../.g.Kh...`....n..(...e%.N+..d....z .......%..U.&c>a...%.l@.d.2'......-5ED.7.',........h.v.N>Rn....b.c..6..~....W..,h...Z.Xi....4|)..........q..}\*/.jYH..r7..)..Fz..~.S......{..Ar..`(...y..Ik`{.I.)...n...A...E.....B`,:..DCD.~..j....2..@8..WW,..c.

                                                                        C:\Users\user\Downloads\IPKGELNTQY.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.854468593972494
                                                                        Encrypted:false
                                                                        SSDEEP:24:vGcZ0J9zFyq6IWAW3/LX9LfeTw6Rd+YUKlXbCpk6tXIB5nx0nvHwLtF+3xVWbD:+E4YqfVWvaRtlLCp9VIB5un4MxSD
                                                                        MD5:7615959A2BB4F33FB5E7E431833BE105
                                                                        SHA1:0708DA03FBCC5E7EADB76B4A26973187509EAFCF
                                                                        SHA-256:4330BDD1810003B856A8ABF7906A572C2EC4079259A1A9E95CAA05C205C19DFB
                                                                        SHA-512:EC0236A15B432F12921AE649B80CF31229F14F833D7E1E70602C605B91CC87972C57C00BA7D2249435A7E4CADA691AFC18F95DF7D3EEB58CC1935D1C62E001C9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE,.SXgv`,.......S.n.G..!.y..s..hPn..P.Cb._f....{..3.9.0..aL+5p...:G7m...O7.4a.ZO..l&.H...1./x..y.WJ..gk..6..Z...v....Vxq]M3......%I1.....y......U'.0S~...G.o..&56T......v;.d...>)..R.R..B...L....a....p.O.. ?.D.'..;`....J..rL.\u^..C..<../T.............\...NPp..I...Z+...#.j.$..(.?..h.+..g.AY...BP.......2V.....M@.....1....1S.....-..61....F~.W.dt....R.m.T..J....wi..8....-.J...y/....%.W.{..wed.\c...........E.e.'y.. }....(....D....3..Z...+5YW..LM..Vo..[ ..OT..^d..?...;....H...G.O+.jE...(d(rtMu..+^..~.d. _..r.....yY...t..~;obe..5Z......>..:..Y..a.F...x.W.. .@q..<.^G..]2..WbG....7...%.{...ps.FB...{...S...Q&..f...4..b}xJ..{.qL.......<.u3.......R{.A....5.{.'K..oc..H.^b."...hCd.J.....N.F.\.*..X:...8PJ."..;..O."!U..x.zY.4l..P...R.6.....;....z...9.Uw'...\.BH..a1.#....|b..}.......a...X~\...Z.F..p9..&..).j.bX...H..\..L.....O...t.....b.'.~...$..(J...d7....06-.".W......:...t..d.*.k4....+...c$.!i4%.........X.@.\.....%..n4..@G..s.i3SD.{|<.....N.x.^.....

                                                                        C:\Users\user\Downloads\IPKGELNTQY.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.854468593972494
                                                                        Encrypted:false
                                                                        SSDEEP:24:vGcZ0J9zFyq6IWAW3/LX9LfeTw6Rd+YUKlXbCpk6tXIB5nx0nvHwLtF+3xVWbD:+E4YqfVWvaRtlLCp9VIB5un4MxSD
                                                                        MD5:7615959A2BB4F33FB5E7E431833BE105
                                                                        SHA1:0708DA03FBCC5E7EADB76B4A26973187509EAFCF
                                                                        SHA-256:4330BDD1810003B856A8ABF7906A572C2EC4079259A1A9E95CAA05C205C19DFB
                                                                        SHA-512:EC0236A15B432F12921AE649B80CF31229F14F833D7E1E70602C605B91CC87972C57C00BA7D2249435A7E4CADA691AFC18F95DF7D3EEB58CC1935D1C62E001C9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGE,.SXgv`,.......S.n.G..!.y..s..hPn..P.Cb._f....{..3.9.0..aL+5p...:G7m...O7.4a.ZO..l&.H...1./x..y.WJ..gk..6..Z...v....Vxq]M3......%I1.....y......U'.0S~...G.o..&56T......v;.d...>)..R.R..B...L....a....p.O.. ?.D.'..;`....J..rL.\u^..C..<../T.............\...NPp..I...Z+...#.j.$..(.?..h.+..g.AY...BP.......2V.....M@.....1....1S.....-..61....F~.W.dt....R.m.T..J....wi..8....-.J...y/....%.W.{..wed.\c...........E.e.'y.. }....(....D....3..Z...+5YW..LM..Vo..[ ..OT..^d..?...;....H...G.O+.jE...(d(rtMu..+^..~.d. _..r.....yY...t..~;obe..5Z......>..:..Y..a.F...x.W.. .@q..<.^G..]2..WbG....7...%.{...ps.FB...{...S...Q&..f...4..b}xJ..{.qL.......<.u3.......R{.A....5.{.'K..oc..H.^b."...hCd.J.....N.F.\.*..X:...8PJ."..;..O."!U..x.zY.4l..P...R.6.....;....z...9.Uw'...\.BH..a1.#....|b..}.......a...X~\...Z.F..p9..&..).j.bX...H..\..L.....O...t.....b.'.~...$..(J...d7....06-.".W......:...t..d.*.k4....+...c$.!i4%.........X.@.\.....%..n4..@G..s.i3SD.{|<.....N.x.^.....

                                                                        C:\Users\user\Downloads\IPKGELNTQY.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.845982918921579
                                                                        Encrypted:false
                                                                        SSDEEP:24:5uKo+uV8RRJE3m6oVDiwM8LAldBFE5vHNuijbEben67haxIYSS2gwKHWbD:5u1PVofE26IS6AD+fNLz67haBwBD
                                                                        MD5:AABEA7AF73BE1EF9F0CE86CE08C3C58F
                                                                        SHA1:047CADF70757DCDD620415A564A666D747EFC4FF
                                                                        SHA-256:EB79612012CC8E177D6007DF3DA76FBB4CBF0DF4BD81404C27FA6B09B23A1679
                                                                        SHA-512:B712172B9BAD2F27BFEC4945FD81EAE882646BE6AC0EE9F3EC6456A240EAF0504C77C973B77789EA5507E2BBC441CD5B0F1C01577A040AE2A8BBB3D9497A20C8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGEP.lj.."..%h\..1u......X....Q....M.,.....X..v..K*.i...w..W.....]("......"j...c{>?1.\z.......0l..O.?e.......&G...|p..M.a....\.0..?...E3..d.F.WM..#FN..O...N.A0....o.9(JQ1nz.7F.n..h..`............D....F....dp5...CisY2.v.o...<B..../66.j...j.8(l.%.........*...+%&._ ...h..VB.D..c.z..;Z..k.).+.I..x.UO.#.=.:..G..&.c{V{-.`@......Z...^...h\4..M..B.`K..H..# ..M...[..A.{.W....4.....n3NtN:Am%.x.b#.Ks...W2m../.........5#.......;.;...W.%g..x}.#.X(n.c.S......A..8!L9..>.-P..j....K.......i'..?fs...Tr0.{..X......Z.a;_..W........\:..X.....W.e..8R..9......ig.-k...L|;.....>...L.. "c=...m_.A..l....c.......a0hb.E.......(....5.&...{......k...KX..}..9..G.t...k.y.........&A~..u3x........Jpd.......!'J_...yi~..i.9.`..o.]2#......a..u.A|......[5.Na.D...1.@...'.(...U..8.>.\..V..+P-......gq.+.\...$.....2$6.&JJ...u.E{.......R...t...BH..}W..,Y..7..VVU)Kl`.>..Z3i1....o....9.|.`........X..?..d.(.U#.3...._.....FL......d..S..O...L.R..f.q.....NE..0.C..J._..q....L...0F...P...

                                                                        C:\Users\user\Downloads\IPKGELNTQY.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.845982918921579
                                                                        Encrypted:false
                                                                        SSDEEP:24:5uKo+uV8RRJE3m6oVDiwM8LAldBFE5vHNuijbEben67haxIYSS2gwKHWbD:5u1PVofE26IS6AD+fNLz67haBwBD
                                                                        MD5:AABEA7AF73BE1EF9F0CE86CE08C3C58F
                                                                        SHA1:047CADF70757DCDD620415A564A666D747EFC4FF
                                                                        SHA-256:EB79612012CC8E177D6007DF3DA76FBB4CBF0DF4BD81404C27FA6B09B23A1679
                                                                        SHA-512:B712172B9BAD2F27BFEC4945FD81EAE882646BE6AC0EE9F3EC6456A240EAF0504C77C973B77789EA5507E2BBC441CD5B0F1C01577A040AE2A8BBB3D9497A20C8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:IPKGEP.lj.."..%h\..1u......X....Q....M.,.....X..v..K*.i...w..W.....]("......"j...c{>?1.\z.......0l..O.?e.......&G...|p..M.a....\.0..?...E3..d.F.WM..#FN..O...N.A0....o.9(JQ1nz.7F.n..h..`............D....F....dp5...CisY2.v.o...<B..../66.j...j.8(l.%.........*...+%&._ ...h..VB.D..c.z..;Z..k.).+.I..x.UO.#.=.:..G..&.c{V{-.`@......Z...^...h\4..M..B.`K..H..# ..M...[..A.{.W....4.....n3NtN:Am%.x.b#.Ks...W2m../.........5#.......;.;...W.%g..x}.#.X(n.c.S......A..8!L9..>.-P..j....K.......i'..?fs...Tr0.{..X......Z.a;_..W........\:..X.....W.e..8R..9......ig.-k...L|;.....>...L.. "c=...m_.A..l....c.......a0hb.E.......(....5.&...{......k...KX..}..9..G.t...k.y.........&A~..u3x........Jpd.......!'J_...yi~..i.9.`..o.]2#......a..u.A|......[5.Na.D...1.@...'.(...U..8.>.\..V..+P-......gq.+.\...$.....2$6.&JJ...u.E{.......R...t...BH..}W..,Y..7..VVU)Kl`.>..Z3i1....o....9.|.`........X..?..d.(.U#.3...._.....FL......d..S..O...L.R..f.q.....NE..0.C..J._..q....L...0F...P...

                                                                        C:\Users\user\Downloads\LSBIHQFDVT.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.840488121294169
                                                                        Encrypted:false
                                                                        SSDEEP:24:Kzezh6bPxwQZ4sf6swpbPVe9TBm2fFplMybqQajQKBCk93lKHp3/zFe/4FLWbD:KzeF6bZwQFf6swprVWm2JqQSCk93lKHS
                                                                        MD5:24EA5B3C9A0FC8FB8D13A2D95F702025
                                                                        SHA1:EAE18F6B35141CBC9AEB18BD6B5D7974AA05DD22
                                                                        SHA-256:4A514383D4BE54FF4B08A3F29F217645BBA3A3A853815A14153306D749589FE5
                                                                        SHA-512:17A0866EE027C558CF7AEFD69AD5BB8B3FCB2B3A1F379ADCB479D9C895DF50F904077F721940D9CF23235B0245456A951A71E152DBA9A7E47BB327C44D9451CC
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIH.7...^..:L..QGo.FG.5U...H.ET.S...D......).....B.+@EW........GUl......%.=.L..D....[........->c:..*.*..+._......-..t...Y.......p~.....9>.v:_..gV...J.YtAz....>3|cS...=...Gv.f...J,!.e1..$V..1t=......HY.?...2.[.@.MfR..v.5#=.......5....ux._...../.]..........T...I..b............Pn8.D9.K.S....e{o.z.......$1{....n.v|..&..5.{.".^...>.9...9..Zy'4.[...C.E...y......7.@6G.>.y....n.'q......./...Rb..:..6.k......c@.?..........Y$....huF..V.7J{.;.....YU..I|.8.............QLQ..Qv..+-.......%.fz..*B]F.Z.su#)g&{_....<| ...I.BJ..e\|.....'...].O.O.fL.g...QXV.... ..12.....;....}...]...^..&w.~o.]b=....v.rK&RI..L."E..i..h... ..Q.......,.u....p.k..~9.~...3....xQ...J......<|.)...&........Y.&d....W..._U.....b..\...>.W...ff...o...".^y......KP.{.[.h..$H...N..K...Bj.{....6..vMJ...~.....O...Z..>$^Xd......E.<.W$1&....#....g.r..8.D...y..9.^.O8...1H;..99...^.$.&....,+W......E0.X.\.......:......t&J."..u.O.(...;m^......r.h.e..Yui.D...%..D....N.1.%A.6.4.`ru0..I..?

                                                                        C:\Users\user\Downloads\LSBIHQFDVT.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.840488121294169
                                                                        Encrypted:false
                                                                        SSDEEP:24:Kzezh6bPxwQZ4sf6swpbPVe9TBm2fFplMybqQajQKBCk93lKHp3/zFe/4FLWbD:KzeF6bZwQFf6swprVWm2JqQSCk93lKHS
                                                                        MD5:24EA5B3C9A0FC8FB8D13A2D95F702025
                                                                        SHA1:EAE18F6B35141CBC9AEB18BD6B5D7974AA05DD22
                                                                        SHA-256:4A514383D4BE54FF4B08A3F29F217645BBA3A3A853815A14153306D749589FE5
                                                                        SHA-512:17A0866EE027C558CF7AEFD69AD5BB8B3FCB2B3A1F379ADCB479D9C895DF50F904077F721940D9CF23235B0245456A951A71E152DBA9A7E47BB327C44D9451CC
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:LSBIH.7...^..:L..QGo.FG.5U...H.ET.S...D......).....B.+@EW........GUl......%.=.L..D....[........->c:..*.*..+._......-..t...Y.......p~.....9>.v:_..gV...J.YtAz....>3|cS...=...Gv.f...J,!.e1..$V..1t=......HY.?...2.[.@.MfR..v.5#=.......5....ux._...../.]..........T...I..b............Pn8.D9.K.S....e{o.z.......$1{....n.v|..&..5.{.".^...>.9...9..Zy'4.[...C.E...y......7.@6G.>.y....n.'q......./...Rb..:..6.k......c@.?..........Y$....huF..V.7J{.;.....YU..I|.8.............QLQ..Qv..+-.......%.fz..*B]F.Z.su#)g&{_....<| ...I.BJ..e\|.....'...].O.O.fL.g...QXV.... ..12.....;....}...]...^..&w.~o.]b=....v.rK&RI..L."E..i..h... ..Q.......,.u....p.k..~9.~...3....xQ...J......<|.)...&........Y.&d....W..._U.....b..\...>.W...ff...o...".^y......KP.{.[.h..$H...N..K...Bj.{....6..vMJ...~.....O...Z..>$^Xd......E.<.W$1&....#....g.r..8.D...y..9.^.O8...1H;..99...^.$.&....,+W......E0.X.\.......:......t&J."..u.O.(...;m^......r.h.e..Yui.D...%..D....N.1.%A.6.4.`ru0..I..?

                                                                        C:\Users\user\Downloads\MXPXCVPDVN.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.847414738326703
                                                                        Encrypted:false
                                                                        SSDEEP:24:IpJnk6NU3vUE+pl9EaUZsUPaVk6SMbrjDS6VcbtDwBjklM62ZSZVeLXJG620yWbD:53vUEIb/U6OhMS6VcRDwJK2ZRXJG62SD
                                                                        MD5:DAA53319FCA4D9B36DBD5746F2289953
                                                                        SHA1:D6B3669B2DA474B5E586F1AA96ABB5DE467D6707
                                                                        SHA-256:7E6ED4152E3AF0B1EFB62193A337677E7B299819C7BA1F95385D4BA3828B7F4E
                                                                        SHA-512:DCEE4AD86AE3320B6AD4839248A4A360559F3ECB6C8F9A3C7EC18C3FC17ABFF9A289452FC68FE414C9886CCA2C598681403171A81980C4AB5C78A830C0E0A384
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC.|._|E....{.~.^~..O.ek.........x...u-......l.....?y]....N.|L.a'...3.{O..I6..!CO0.d..e......z\......._?..|,..vb........0..t.....E...-....{...6.')~Yr..z.n.b.....T.M.O..m...yQ..T.. ......}..H:L....`..g.f.,;a...w....c-.....o.[...i8.?...l..L.4.t........s...F.B....J.........5.tI4..9...91">.3..............`3y.[.&...6..bA"~;.N.g..32o..U..>0K.HA...&.L......T....K.....-x...B......E`.B.X3.JDZ..m.9....9c.5...2.R<Y.!xA...8..,2^'.gp.D.....c...|.6.T.>.R.M..@.n....Y..g.X)ZdA,o.G>...u0.C..f...}..E*..e.4%..e.n...T.+..q.N4..e0x.O".........{}.(...Gu.X..Mb..l...*=I..........W.....X.K.b.A.]..... .}....Q....f..F-.....+..3J.M..d_.07...93..;.<A. }.:Qz..."..xS.Lc.....F..S+b<4_l..]9..Z ...g..6_."...l.....s^...`.GH..5.\c...~.B..fI..i.q.?../....=..pIK.}+....Hf...w.t.C#..)...Xk.6.V..OK!.|l..$`H.3v r.`...HQOT..+.>5b2.mix*|.....U...p"...F...s...01..3#.h.o.''..Q.. ..6.K@\5S..]..B.....nh...........H..Z..q<...SWq...K.W...-......V.5...\..5....l.(...b..i7.[6.

                                                                        C:\Users\user\Downloads\MXPXCVPDVN.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.847414738326703
                                                                        Encrypted:false
                                                                        SSDEEP:24:IpJnk6NU3vUE+pl9EaUZsUPaVk6SMbrjDS6VcbtDwBjklM62ZSZVeLXJG620yWbD:53vUEIb/U6OhMS6VcRDwJK2ZRXJG62SD
                                                                        MD5:DAA53319FCA4D9B36DBD5746F2289953
                                                                        SHA1:D6B3669B2DA474B5E586F1AA96ABB5DE467D6707
                                                                        SHA-256:7E6ED4152E3AF0B1EFB62193A337677E7B299819C7BA1F95385D4BA3828B7F4E
                                                                        SHA-512:DCEE4AD86AE3320B6AD4839248A4A360559F3ECB6C8F9A3C7EC18C3FC17ABFF9A289452FC68FE414C9886CCA2C598681403171A81980C4AB5C78A830C0E0A384
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MXPXC.|._|E....{.~.^~..O.ek.........x...u-......l.....?y]....N.|L.a'...3.{O..I6..!CO0.d..e......z\......._?..|,..vb........0..t.....E...-....{...6.')~Yr..z.n.b.....T.M.O..m...yQ..T.. ......}..H:L....`..g.f.,;a...w....c-.....o.[...i8.?...l..L.4.t........s...F.B....J.........5.tI4..9...91">.3..............`3y.[.&...6..bA"~;.N.g..32o..U..>0K.HA...&.L......T....K.....-x...B......E`.B.X3.JDZ..m.9....9c.5...2.R<Y.!xA...8..,2^'.gp.D.....c...|.6.T.>.R.M..@.n....Y..g.X)ZdA,o.G>...u0.C..f...}..E*..e.4%..e.n...T.+..q.N4..e0x.O".........{}.(...Gu.X..Mb..l...*=I..........W.....X.K.b.A.]..... .}....Q....f..F-.....+..3J.M..d_.07...93..;.<A. }.:Qz..."..xS.Lc.....F..S+b<4_l..]9..Z ...g..6_."...l.....s^...`.GH..5.\c...~.B..fI..i.q.?../....=..pIK.}+....Hf...w.t.C#..)...Xk.6.V..OK!.|l..$`H.3v r.`...HQOT..+.>5b2.mix*|.....U...p"...F...s...01..3#.h.o.''..Q.. ..6.K@\5S..]..B.....nh...........H..Z..q<...SWq...K.W...-......V.5...\..5....l.(...b..i7.[6.

                                                                        C:\Users\user\Downloads\NEBFQQYWPS.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.862264429809367
                                                                        Encrypted:false
                                                                        SSDEEP:24:v0Rj5okDMtt1gx8OZpFYp6b2j5kqa9BjZUKMNerTgXAia17Il8cZOgWbD:sRj5ofHeKOZTOpj5krBjZULc3El8vVD
                                                                        MD5:495E6B5DDC549589A826729BB5541A69
                                                                        SHA1:DB84E4F200471FD725E2EFFD63FD747E646B8E33
                                                                        SHA-256:2288BAECD44B522F404DECAA6FCEE1531C67047ABEB81A45ED0A3C0B2026ACCB
                                                                        SHA-512:5EABD401D98A83ADDBFB5741E191EFE73210B3E34D8517E9C01CB019429641264D716F01827691E830538B607F5B546AFACCCCB25A7449187CB6167CCC829F2C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ_.bm.4._..[....Fd.}..G......R.`.=..!W.5r.#9..K../u..4Oo.6+.....['A..&.i.]6.f>w../...H.@...`..N}.V.,}...F...<.....X.r/t...,Z..7.....;:.*.I. ..a..YEF/||W.!.mM..%.....&...("..AIK.-.......di...oX..........%..n....6.....%X<h.S..1..gX-...u........w{.....Q.'U.FM......M..O..H.G.."..K.TS7......+=..!-.lP).kh...H....WI..f5......U,..V.Q.9..h.&..O...D.[....L].W...vR.5L.o1~..-. ......u.O.W,..~g.....u.p.Z?Z$...ac0..4tY...........h(..h=.......?..I5... 16....4.*.;....A.Q,{.../..F....v.y...%..6.r|.}1...D@.......q.*.k....o4....h.$l$.,....8.....k.RPT._...?F.pk[L.... ...Wb.L....Y.'<.B...1.0...+.I.t.2..V..y$n..z/..U.1YB..t......BA..L.2yn<w....lx.,. T..\.fLZ...c..{..>.....p....<..v.......Q.)..g.!%.$<.l....R......;.{.....Eb.F.......$rb.M...P....|...;...P....?...7..^.P..%|H7.:......sG.A)..r*<e.}..Sg....t.1..:.k.b..9O..T..x.z..~.......Mm.....t........2.H3....IS.l..,..9i*.QT........:i.I.c.hG(..............3...f$..;8......s.1I.....i`.out*#K..?..)T..qEG.N

                                                                        C:\Users\user\Downloads\NEBFQQYWPS.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.862264429809367
                                                                        Encrypted:false
                                                                        SSDEEP:24:v0Rj5okDMtt1gx8OZpFYp6b2j5kqa9BjZUKMNerTgXAia17Il8cZOgWbD:sRj5ofHeKOZTOpj5krBjZULc3El8vVD
                                                                        MD5:495E6B5DDC549589A826729BB5541A69
                                                                        SHA1:DB84E4F200471FD725E2EFFD63FD747E646B8E33
                                                                        SHA-256:2288BAECD44B522F404DECAA6FCEE1531C67047ABEB81A45ED0A3C0B2026ACCB
                                                                        SHA-512:5EABD401D98A83ADDBFB5741E191EFE73210B3E34D8517E9C01CB019429641264D716F01827691E830538B607F5B546AFACCCCB25A7449187CB6167CCC829F2C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ_.bm.4._..[....Fd.}..G......R.`.=..!W.5r.#9..K../u..4Oo.6+.....['A..&.i.]6.f>w../...H.@...`..N}.V.,}...F...<.....X.r/t...,Z..7.....;:.*.I. ..a..YEF/||W.!.mM..%.....&...("..AIK.-.......di...oX..........%..n....6.....%X<h.S..1..gX-...u........w{.....Q.'U.FM......M..O..H.G.."..K.TS7......+=..!-.lP).kh...H....WI..f5......U,..V.Q.9..h.&..O...D.[....L].W...vR.5L.o1~..-. ......u.O.W,..~g.....u.p.Z?Z$...ac0..4tY...........h(..h=.......?..I5... 16....4.*.;....A.Q,{.../..F....v.y...%..6.r|.}1...D@.......q.*.k....o4....h.$l$.,....8.....k.RPT._...?F.pk[L.... ...Wb.L....Y.'<.B...1.0...+.I.t.2..V..y$n..z/..U.1YB..t......BA..L.2yn<w....lx.,. T..\.fLZ...c..{..>.....p....<..v.......Q.)..g.!%.$<.l....R......;.{.....Eb.F.......$rb.M...P....|...;...P....?...7..^.P..%|H7.:......sG.A)..r*<e.}..Sg....t.1..:.k.b..9O..T..x.z..~.......Mm.....t........2.H3....IS.l..,..9i*.QT........:i.I.c.hG(..............3...f$..;8......s.1I.....i`.out*#K..?..)T..qEG.N

                                                                        C:\Users\user\Downloads\NEBFQQYWPS.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8510084941704195
                                                                        Encrypted:false
                                                                        SSDEEP:24:QOTnvJ7/HSauNwMKJEwsJfQ4VGtN29I7n5XPuslVK371dqZWG+DOOpHB0yVxCvJX:QMR7/yNwVJlmAjgIL5XPuHr1d7DOaTCt
                                                                        MD5:F208735C9D55846D39616FD8A0E765AD
                                                                        SHA1:A2A601087D2004ADED299DFADFF808DA80D1CE53
                                                                        SHA-256:3A473C7A740F967C7117C7F142D4AEF4CE531DD68204AACDEE89932F26A9E158
                                                                        SHA-512:3409DAFCC969DFED9215CDAADEBFD6B9EF661E047C04983E3DE73FB61ABD654C84CB2D15ACF9EC079E8B5169DF0E4D1982A72CAE3E15CCB0B9980055E3864F29
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ.....t#c...C..m..p.y..."...%.K.A."-&..T.u....=.q....x...q..-(c.Q.Or.....|........mda.n.5.d...N..t.7....|.P.h.'..H....fU.'VR.....+..VP........|.".#.Z.-"|.[...jW..(.....O....PN.-.i..K....../..._..K0.....h.k@..{.Qy..}.t.z...&L8W).\=..$u@.I..=...K.3G:..+..'+..Mq.....J..,z..'.rz1.D..|A...0xP..%..gcecp....`......%...&..M..#U.....u......Ov..y.T.g..7.=.<R....?....R........x.P.-..).3.C.K#.d..V.\18..&C\...M.....q.. ....V9.~...O.FJ..%`-.c._".X.+yh.........W'-..m.......~..8.u.j..XA......k.. .[._.G.?.[..Zx-..v.<7.'].....T.|.K.0..1..q.p;.i..K....q!....)..S......=..q.&..AGZ..; Pn....y....g.....5....R.2.=zT...~(..N.......@....."...&.n.-...*....."........}*..... ..../..um......qS.....".wg...u...0i.k..[...=.`PW.ki..*^. g.........7.k..L.=..'..g:..8F..}D....B...t.r..%d;./9.....Y.9-@........g.s.Xn.)..C........\....U......]q?.pT.S.{..& .^..m*....G....E...Y..]...).j.....>.._....P.l....?.v...z.o....e'<A..g.iq6.5./...VK.=.R....,R......T8f].M\+.46....,..F..?/ga/V.

                                                                        C:\Users\user\Downloads\NEBFQQYWPS.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8510084941704195
                                                                        Encrypted:false
                                                                        SSDEEP:24:QOTnvJ7/HSauNwMKJEwsJfQ4VGtN29I7n5XPuslVK371dqZWG+DOOpHB0yVxCvJX:QMR7/yNwVJlmAjgIL5XPuHr1d7DOaTCt
                                                                        MD5:F208735C9D55846D39616FD8A0E765AD
                                                                        SHA1:A2A601087D2004ADED299DFADFF808DA80D1CE53
                                                                        SHA-256:3A473C7A740F967C7117C7F142D4AEF4CE531DD68204AACDEE89932F26A9E158
                                                                        SHA-512:3409DAFCC969DFED9215CDAADEBFD6B9EF661E047C04983E3DE73FB61ABD654C84CB2D15ACF9EC079E8B5169DF0E4D1982A72CAE3E15CCB0B9980055E3864F29
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:NEBFQ.....t#c...C..m..p.y..."...%.K.A."-&..T.u....=.q....x...q..-(c.Q.Or.....|........mda.n.5.d...N..t.7....|.P.h.'..H....fU.'VR.....+..VP........|.".#.Z.-"|.[...jW..(.....O....PN.-.i..K....../..._..K0.....h.k@..{.Qy..}.t.z...&L8W).\=..$u@.I..=...K.3G:..+..'+..Mq.....J..,z..'.rz1.D..|A...0xP..%..gcecp....`......%...&..M..#U.....u......Ov..y.T.g..7.=.<R....?....R........x.P.-..).3.C.K#.d..V.\18..&C\...M.....q.. ....V9.~...O.FJ..%`-.c._".X.+yh.........W'-..m.......~..8.u.j..XA......k.. .[._.G.?.[..Zx-..v.<7.'].....T.|.K.0..1..q.p;.i..K....q!....)..S......=..q.&..AGZ..; Pn....y....g.....5....R.2.=zT...~(..N.......@....."...&.n.-...*....."........}*..... ..../..um......qS.....".wg...u...0i.k..[...=.`PW.ki..*^. g.........7.k..L.=..'..g:..8F..}D....B...t.r..%d;./9.....Y.9-@........g.s.Xn.)..C........\....U......]q?.pT.S.{..& .^..m*....G....E...Y..]...).j.....>.._....P.l....?.v...z.o....e'<A..g.iq6.5./...VK.=.R....,R......T8f].M\+.46....,..F..?/ga/V.

                                                                        C:\Users\user\Downloads\PIVFAGEAAV.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.847874851916997
                                                                        Encrypted:false
                                                                        SSDEEP:24:KqEzJcFteH0ePyXqBo5ivzipC20J4G3U/tyJiLW0qGOwWbD:K/uHeHXyaBoi4C2I4GkG0qGuD
                                                                        MD5:857758F158809F897D71C013D8350E5A
                                                                        SHA1:51024B6958D45DC670924320A4D6AA8368ACB27B
                                                                        SHA-256:E9E49ACD0CFEE137A0F3B92C5606BF60778E7B8B291858EF57FB05A363A53A72
                                                                        SHA-512:EC3FD82FBDC896F9CDAEDB9A6EDD7A31568D96331193D76BCE3A8D881B0640501FACCF49AE0D55C037128409BE7B631AA987ECBC6906071F853652AFC146E5EE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.I.-..K.VT.U::.}..K....$a.?[...|v..7.N6........k..W.W........\...v.j.!.....[#..r.7b.s......Kvh....=..&..?.p6G_...N>.".].]V.213j..@..HL4e.-.....b..q.F...4.v.i.[G.;.W.....w.<...[........K..eA..7..+...cZe.f..h.^YO.i-.#.....E...~k)..4.7#>.J.m..!....M...'..b....,!...x.LB.1.:6....H=|...r...J.E+...g.`.b.....D..... .Q).}...D..T...Q./...ZC...w...E....P+S...q.o.^,[&!I%V...tQ...<..........f...'4k.5..Ls. .....\................z..L...".{.......P...4...$K.....1W_q......mk..........y........)|Ol..>R%..m.a-....a....Yk...Uu..K$0'....T[..S.e...W....}92.P.(....P.o...n.4H.F.HA. .Zh..a.7.U.....K(K....=...@uP4...3...F!.....Pe.4.Y..3.6..{4....tBN.g....m.Ul.%~...7"...MM*yB.QG.O.....rg..Y...a...#".q[..`..LF.i.L5;..ACu..G.:..J....YK.8..:.....9...........(....j9....!.p^.k.j...j.qR<...Q.x..v48./2.a....&......C...."9r&...,..P...3.l..v.*f.Xd^.r........ q....u...EF:.%D.x..u..<<..Nb.R..ld....M..Q....<..U...,.f..]..~....-8_...O.....j.f!...'..W.n.g......Bi6pM...

                                                                        C:\Users\user\Downloads\PIVFAGEAAV.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.847874851916997
                                                                        Encrypted:false
                                                                        SSDEEP:24:KqEzJcFteH0ePyXqBo5ivzipC20J4G3U/tyJiLW0qGOwWbD:K/uHeHXyaBoi4C2I4GkG0qGuD
                                                                        MD5:857758F158809F897D71C013D8350E5A
                                                                        SHA1:51024B6958D45DC670924320A4D6AA8368ACB27B
                                                                        SHA-256:E9E49ACD0CFEE137A0F3B92C5606BF60778E7B8B291858EF57FB05A363A53A72
                                                                        SHA-512:EC3FD82FBDC896F9CDAEDB9A6EDD7A31568D96331193D76BCE3A8D881B0640501FACCF49AE0D55C037128409BE7B631AA987ECBC6906071F853652AFC146E5EE
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA.I.-..K.VT.U::.}..K....$a.?[...|v..7.N6........k..W.W........\...v.j.!.....[#..r.7b.s......Kvh....=..&..?.p6G_...N>.".].]V.213j..@..HL4e.-.....b..q.F...4.v.i.[G.;.W.....w.<...[........K..eA..7..+...cZe.f..h.^YO.i-.#.....E...~k)..4.7#>.J.m..!....M...'..b....,!...x.LB.1.:6....H=|...r...J.E+...g.`.b.....D..... .Q).}...D..T...Q./...ZC...w...E....P+S...q.o.^,[&!I%V...tQ...<..........f...'4k.5..Ls. .....\................z..L...".{.......P...4...$K.....1W_q......mk..........y........)|Ol..>R%..m.a-....a....Yk...Uu..K$0'....T[..S.e...W....}92.P.(....P.o...n.4H.F.HA. .Zh..a.7.U.....K(K....=...@uP4...3...F!.....Pe.4.Y..3.6..{4....tBN.g....m.Ul.%~...7"...MM*yB.QG.O.....rg..Y...a...#".q[..`..LF.i.L5;..ACu..G.:..J....YK.8..:.....9...........(....j9....!.p^.k.j...j.qR<...Q.x..v48./2.a....&......C...."9r&...,..P...3.l..v.*f.Xd^.r........ q....u...EF:.%D.x..u..<<..Nb.R..ld....M..Q....<..U...,.f..]..~....-8_...O.....j.f!...'..W.n.g......Bi6pM...

                                                                        C:\Users\user\Downloads\PIVFAGEAAV.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.844680972872518
                                                                        Encrypted:false
                                                                        SSDEEP:24:eGmAQLyvhkLGyQq5D78R6K11QPCVeSkkbk02bLAIQFAxyADBWbD:e1ARChe1QPC9bk0UL9xLDeD
                                                                        MD5:8672C460162D30B8081B84A620DCB84D
                                                                        SHA1:13352021829ACFA88C015DBC6AC0FD19448B3B43
                                                                        SHA-256:3FDA0F5EB195346767CCEE84D78C1DB9676C8186D58AE8677CB3E5DA4A9BF104
                                                                        SHA-512:4106B1984938B1AEC8D9DBD138DC3BF66A8F4A7A9195344FB8E7A7AE087D61991C47AF6148EDA71A858692580EC74ED3B21BDEE0C12B453ECCA5E66FEFD964AD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA`RV.`.........g.......l.?yo#8UH.#C.k...R.A.>c......*...E....u..1h$.e...^N..oOw0...R....C..0I.e.Q^2#F..PhM..Eo)8...Z...x.......<..f]..uuM..2+.DT..RyR..q.l2o.G.g.!C^J..<:.Qe..../.b|w>...l...|..;.Y.p...o%.DNN'Z.H...?..2..d..q.}?u3.x......5zI...F.Z....mLg..5.o....&.......|..&5V.i@.......#...qw."V.Z..|u.S...3z...Y..K&.L.S._M.r..5....4.y....F.,...[.w3..3K..z`.R......E.IYmD_R.O...U...Hp...........O,.R.K%A.].W9./..HF.'o.2...{./.E..n.U..)t|.FEdv..i.^+.h]fa..D.8...=..=%.ELUT..5.....A..J7N....x.6#.K.#.N._....MhVe.j.C.\..p....%.|k.f(.......p...4..z....+V.x...\..o~k........A.Qv.yY')..I...h.?((4<.?.{^....]m.!.I@.-.}a.......6.m.U..Ze.,lM...e..^._...e....F...7=.....9..-...u...H.......v|.19..e..a..g..J..b_{...n..v.1..t...(.I..n..C.}Kq...`......L.....{v.Zy/......e.&6....z...x#...^..+vX..GF..9^.^n..]...P&....e.dh.K.s.N....'...yn*....}...._.(.m...^9..(...H....p.?M.R..r....r..X.y.,f.*iGx. .M.....@..,:.....c.7@,...$.].*.......j...0w1...L..|yK0.Yr...E...

                                                                        C:\Users\user\Downloads\PIVFAGEAAV.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.844680972872518
                                                                        Encrypted:false
                                                                        SSDEEP:24:eGmAQLyvhkLGyQq5D78R6K11QPCVeSkkbk02bLAIQFAxyADBWbD:e1ARChe1QPC9bk0UL9xLDeD
                                                                        MD5:8672C460162D30B8081B84A620DCB84D
                                                                        SHA1:13352021829ACFA88C015DBC6AC0FD19448B3B43
                                                                        SHA-256:3FDA0F5EB195346767CCEE84D78C1DB9676C8186D58AE8677CB3E5DA4A9BF104
                                                                        SHA-512:4106B1984938B1AEC8D9DBD138DC3BF66A8F4A7A9195344FB8E7A7AE087D61991C47AF6148EDA71A858692580EC74ED3B21BDEE0C12B453ECCA5E66FEFD964AD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PIVFA`RV.`.........g.......l.?yo#8UH.#C.k...R.A.>c......*...E....u..1h$.e...^N..oOw0...R....C..0I.e.Q^2#F..PhM..Eo)8...Z...x.......<..f]..uuM..2+.DT..RyR..q.l2o.G.g.!C^J..<:.Qe..../.b|w>...l...|..;.Y.p...o%.DNN'Z.H...?..2..d..q.}?u3.x......5zI...F.Z....mLg..5.o....&.......|..&5V.i@.......#...qw."V.Z..|u.S...3z...Y..K&.L.S._M.r..5....4.y....F.,...[.w3..3K..z`.R......E.IYmD_R.O...U...Hp...........O,.R.K%A.].W9./..HF.'o.2...{./.E..n.U..)t|.FEdv..i.^+.h]fa..D.8...=..=%.ELUT..5.....A..J7N....x.6#.K.#.N._....MhVe.j.C.\..p....%.|k.f(.......p...4..z....+V.x...\..o~k........A.Qv.yY')..I...h.?((4<.?.{^....]m.!.I@.-.}a.......6.m.U..Ze.,lM...e..^._...e....F...7=.....9..-...u...H.......v|.19..e..a..g..J..b_{...n..v.1..t...(.I..n..C.}Kq...`......L.....{v.Zy/......e.&6....z...x#...^..+vX..GF..9^.^n..]...P&....e.dh.K.s.N....'...yn*....}...._.(.m...^9..(...H....p.?M.R..r....r..X.y.,f.*iGx. .M.....@..,:.....c.7@,...$.].*.......j...0w1...L..|yK0.Yr...E...

                                                                        C:\Users\user\Downloads\PWCCAWLGRE.png

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.83162192980224
                                                                        Encrypted:false
                                                                        SSDEEP:24:Q0roemIatAd6Fz2io1K5tacF+h9FwqmioIrYbHa2ljBGGtgJ00DRTe89YWbD:QRIatAd6Fz2hM5tUXwbla2ljBGJLR68P
                                                                        MD5:D00E8B665E467DBD192E098E81F32D7F
                                                                        SHA1:67D81082EFA8B8B49B2AF942BF24E498EBD964A0
                                                                        SHA-256:50446C302E0E0DDF49260C5BCBBB02BA45427D533C39A6E772C45EE89611E82E
                                                                        SHA-512:4BB08868E59135D663D58CCB880FD9DD85F96C8BB2C5B81898E0E666E570CF0F97751CB8F6DACB19FAB976F1FAF9984A02E456FDC60C3D64A4510A27EDFD8FC9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA.l......{..m.....BSuT0....t..........Y.8..: ...f.......md.6...9.$.u...abN.*...z\m.}.C.z@.VN..9y..b*sx..^...9L.7.....y".V.-{ja..!Z......U.!f..6...\.C.;?.p......'F.c`..U.<u....>U...?...eA8{.e..{....E.;`.h......a..5.9...m..9.{.....i...K9....Zx>'+.E..O2p...w'`H...@`V.?X,....5.4w}..I.C.z.z.?j5@.&....P..Sn..J....%..T...I.:...g.j.f..............9r......;K[.*'.I.......!.v.P.M.....3....=.{......Y.xz..}Z...:.V.@..._#......./#.;..)....-..b$..c..F...anl..<............\.<.ko..x\8.:..#`a..& .e...3zWR.X..*......3}.%A.D._._-..3lUbn`.}....2....)+.l;.@.G.^[......cj8.2!*2..".......B.5........K...........>..0:3k..........T.........`G.......N\..I.N.V...W.Z'..[N.w..4...W....$..e.U....bH.....SM.(T&..S...f._.I1........|.F....9..k#.[.t..>....Y......,....D|.wF.....@..o.....%...A.....K......{.F....}...[.(*5.3.a.O...M..mz.".....N...Vxz.Mn..~4u.B\..{.......>.BKB.P.......q..~.....n.Z..|?...).`K->...v.. .x.Wz...e..\SSS"O..w.N.....B....X. ..@.!....,=....j

                                                                        C:\Users\user\Downloads\PWCCAWLGRE.png.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.83162192980224
                                                                        Encrypted:false
                                                                        SSDEEP:24:Q0roemIatAd6Fz2io1K5tacF+h9FwqmioIrYbHa2ljBGGtgJ00DRTe89YWbD:QRIatAd6Fz2hM5tUXwbla2ljBGJLR68P
                                                                        MD5:D00E8B665E467DBD192E098E81F32D7F
                                                                        SHA1:67D81082EFA8B8B49B2AF942BF24E498EBD964A0
                                                                        SHA-256:50446C302E0E0DDF49260C5BCBBB02BA45427D533C39A6E772C45EE89611E82E
                                                                        SHA-512:4BB08868E59135D663D58CCB880FD9DD85F96C8BB2C5B81898E0E666E570CF0F97751CB8F6DACB19FAB976F1FAF9984A02E456FDC60C3D64A4510A27EDFD8FC9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:PWCCA.l......{..m.....BSuT0....t..........Y.8..: ...f.......md.6...9.$.u...abN.*...z\m.}.C.z@.VN..9y..b*sx..^...9L.7.....y".V.-{ja..!Z......U.!f..6...\.C.;?.p......'F.c`..U.<u....>U...?...eA8{.e..{....E.;`.h......a..5.9...m..9.{.....i...K9....Zx>'+.E..O2p...w'`H...@`V.?X,....5.4w}..I.C.z.z.?j5@.&....P..Sn..J....%..T...I.:...g.j.f..............9r......;K[.*'.I.......!.v.P.M.....3....=.{......Y.xz..}Z...:.V.@..._#......./#.;..)....-..b$..c..F...anl..<............\.<.ko..x\8.:..#`a..& .e...3zWR.X..*......3}.%A.D._._-..3lUbn`.}....2....)+.l;.@.G.^[......cj8.2!*2..".......B.5........K...........>..0:3k..........T.........`G.......N\..I.N.V...W.Z'..[N.w..4...W....$..e.U....bH.....SM.(T&..S...f._.I1........|.F....9..k#.[.t..>....Y......,....D|.wF.....@..o.....%...A.....K......{.F....}...[.(*5.3.a.O...M..mz.".....N...Vxz.Mn..~4u.B\..{.......>.BKB.P.......q..~.....n.Z..|?...).`K->...v.. .x.Wz...e..\SSS"O..w.N.....B....X. ..@.!....,=....j

                                                                        C:\Users\user\Downloads\QCFWYSKMHA.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.84757434410399
                                                                        Encrypted:false
                                                                        SSDEEP:24:nRiNCY4GCbTlpU7Ril1fv9oy7UXUE6b6ZXb5HMavfTMIWbD:nQCXleQbAXpJMND
                                                                        MD5:A5F23074276EC1858DE24F0DE8F303BD
                                                                        SHA1:76888A2168F01C9926ED86AAF994260DC784F2E1
                                                                        SHA-256:DB0A43A7B309696ECFB161D3B4CA650F3A55D18A21FE3B93A57E8B369CC74EB9
                                                                        SHA-512:B223A590993E0DD80F2AC34C9A9920DF9CD8EFDF23416BD6DF611FCCA313363AC31F02C59FD06A83B54AE18114E64466FF27FC80EF9394F9AD41E44BFBDBDFE1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY.s@._.%H.._.7]%X\.Al\6.C.f.z..V....P.........S.-.........J......<*.D;...b.....H........0.......{`.=}.U.&Z.}.K..X.d.Y..Q....)..K.....4.rf..p....Z..WW.S.(.q..$N.o.(bb>.zK.V..6.....0.q..y.2c)W*d9........ ..~..V......=...~.....r.......f.....t.+..O.........}..D=... |z...P....u..w.`hw<vF5.20..........)~..Gw1.,yE.u.-..Wo%HJ..c...Ae.;4.y....V?.p|......J~.2x......g.{.73WU..e...6~J..z...E.tb..aFK]..y&R.(m..Y.c#@..".q..O.E...R.....{...N....A....)..6..O -....Y.u..Gw..'.......a..]..H..].1..}A...{]...r..j.z@......5..........2G....`.@uG&:.j..9.SJ.VzOFyT.....7..^.ZnD.?.1L.>q/.[.....YW.SEG........0.Fh:......S.....6s.&.....~..JiQ.J%....c.q*.q...../...[..:+.`.z.X....I.....9.K....!.O.....|...PCq.......4..]H.........x.W.C.;......... ..4@.0....8.jQu....z.5j4...O'i..b..u.@z...Y.?..O......,.9.O.....s..,15.$.r>...]...N..o.RO.U.!WR...u......-...^.'..[.BNW.P.W.i.>..F....2w+.[ {N.%..S....{IGb.....N.x..F...8....bC.0...r.} X..a.a9.k..t8.$.AOh.`.$>.*...6JA...W`..(.I.

                                                                        C:\Users\user\Downloads\QCFWYSKMHA.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.84757434410399
                                                                        Encrypted:false
                                                                        SSDEEP:24:nRiNCY4GCbTlpU7Ril1fv9oy7UXUE6b6ZXb5HMavfTMIWbD:nQCXleQbAXpJMND
                                                                        MD5:A5F23074276EC1858DE24F0DE8F303BD
                                                                        SHA1:76888A2168F01C9926ED86AAF994260DC784F2E1
                                                                        SHA-256:DB0A43A7B309696ECFB161D3B4CA650F3A55D18A21FE3B93A57E8B369CC74EB9
                                                                        SHA-512:B223A590993E0DD80F2AC34C9A9920DF9CD8EFDF23416BD6DF611FCCA313363AC31F02C59FD06A83B54AE18114E64466FF27FC80EF9394F9AD41E44BFBDBDFE1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QCFWY.s@._.%H.._.7]%X\.Al\6.C.f.z..V....P.........S.-.........J......<*.D;...b.....H........0.......{`.=}.U.&Z.}.K..X.d.Y..Q....)..K.....4.rf..p....Z..WW.S.(.q..$N.o.(bb>.zK.V..6.....0.q..y.2c)W*d9........ ..~..V......=...~.....r.......f.....t.+..O.........}..D=... |z...P....u..w.`hw<vF5.20..........)~..Gw1.,yE.u.-..Wo%HJ..c...Ae.;4.y....V?.p|......J~.2x......g.{.73WU..e...6~J..z...E.tb..aFK]..y&R.(m..Y.c#@..".q..O.E...R.....{...N....A....)..6..O -....Y.u..Gw..'.......a..]..H..].1..}A...{]...r..j.z@......5..........2G....`.@uG&:.j..9.SJ.VzOFyT.....7..^.ZnD.?.1L.>q/.[.....YW.SEG........0.Fh:......S.....6s.&.....~..JiQ.J%....c.q*.q...../...[..:+.`.z.X....I.....9.K....!.O.....|...PCq.......4..]H.........x.W.C.;......... ..4@.0....8.jQu....z.5j4...O'i..b..u.@z...Y.?..O......,.9.O.....s..,15.$.r>...]...N..o.RO.U.!WR...u......-...^.'..[.BNW.P.W.i.>..F....2w+.[ {N.%..S....{IGb.....N.x..F...8....bC.0...r.} X..a.a9.k..t8.$.AOh.`.$>.*...6JA...W`..(.I.

                                                                        C:\Users\user\Downloads\QNCYCDFIJJ.jpg

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.852139337184877
                                                                        Encrypted:false
                                                                        SSDEEP:24:bTSQbmL+4+Khlv24gH6zd2cxbCLkmTb2vTdAq65FTuNomvDfeQ1j99WbD:nSOmLOKz+4C6qF2vTdx6qNoYCSsD
                                                                        MD5:8C1EEA946489C98F6B801722EC0EF468
                                                                        SHA1:672100849B8D70575AA59B9A02B6DEB79AD071C6
                                                                        SHA-256:1B796A80B37A89424D84DAF5EA27357B02C510CD695C2D2F9341140F870DA24A
                                                                        SHA-512:4FA75D8CD997023CDF63BB52E015A7FA655CA6E6E3618D3DF098EFC5EEECFB71B48B80E261C47D2010C5A7B8A3B7ADF433023AE4717424196404029A25547F73
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC......R.R.M+..-9p..91.....sk...&.s.OA..._.f......s...e.Ll...2.........v.&...........@....~K.<...Z7.Y..BMg..<?xI......I..O;O..@.aR...cS.9>5.....C.5...<...v&....g.....K~+.g8+"..+../9...;.....[........l.g..=(6.#..#.. ...dLd7.2:s7....e.m..6......l....^`-..~....M..}iT........'..:........{ w........S..]..6.%..w...cGfS..e.........W4.J,D...y5..w..,L.?..!.h.........y......R.X.....I9.^!.F.K<aN...\.*y.6..&].o.......j.e...I*.t=$..{..K..0;'..U..v....Hi..#.&..v.....b..'y....+..I..B..D...|a.%........%.q.9..#...Ic..A..3UR.F...(..gv..W.....-.Q..G(.......,e$.A....r...1S6u...4.9csI.O...t..E.(R$....I..i...5...R...F....1.G;H)4w.8+.....,@..B.....|R.D.M .O.K..}.Hwk.D.xf..8..6..*.$8+.~..X..gu F.9=..aB......].....D._........FU.m....;-.}...Y.F..B=hp....X...R..\nsP.[.!s...*.....z.!.p..... . ....U..c.+....3..9.bI..?Y.3~..+..../.21.8..H"d.....A..o....-rZ:...- ......y......Y..+.t.c .G...5.\.K..........B.m&{.....zi.:. )..T.S.k...o/...U..O...Y?....!...T...O.J

                                                                        C:\Users\user\Downloads\QNCYCDFIJJ.jpg.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.852139337184877
                                                                        Encrypted:false
                                                                        SSDEEP:24:bTSQbmL+4+Khlv24gH6zd2cxbCLkmTb2vTdAq65FTuNomvDfeQ1j99WbD:nSOmLOKz+4C6qF2vTdx6qNoYCSsD
                                                                        MD5:8C1EEA946489C98F6B801722EC0EF468
                                                                        SHA1:672100849B8D70575AA59B9A02B6DEB79AD071C6
                                                                        SHA-256:1B796A80B37A89424D84DAF5EA27357B02C510CD695C2D2F9341140F870DA24A
                                                                        SHA-512:4FA75D8CD997023CDF63BB52E015A7FA655CA6E6E3618D3DF098EFC5EEECFB71B48B80E261C47D2010C5A7B8A3B7ADF433023AE4717424196404029A25547F73
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:QNCYC......R.R.M+..-9p..91.....sk...&.s.OA..._.f......s...e.Ll...2.........v.&...........@....~K.<...Z7.Y..BMg..<?xI......I..O;O..@.aR...cS.9>5.....C.5...<...v&....g.....K~+.g8+"..+../9...;.....[........l.g..=(6.#..#.. ...dLd7.2:s7....e.m..6......l....^`-..~....M..}iT........'..:........{ w........S..]..6.%..w...cGfS..e.........W4.J,D...y5..w..,L.?..!.h.........y......R.X.....I9.^!.F.K<aN...\.*y.6..&].o.......j.e...I*.t=$..{..K..0;'..U..v....Hi..#.&..v.....b..'y....+..I..B..D...|a.%........%.q.9..#...Ic..A..3UR.F...(..gv..W.....-.Q..G(.......,e$.A....r...1S6u...4.9csI.O...t..E.(R$....I..i...5...R...F....1.G;H)4w.8+.....,@..B.....|R.D.M .O.K..}.Hwk.D.xf..8..6..*.$8+.~..X..gu F.9=..aB......].....D._........FU.m....;-.}...Y.F..B=hp....X...R..\nsP.[.!s...*.....z.!.p..... . ....U..c.+....3..9.bI..?Y.3~..+..../.21.8..H"d.....A..o....-rZ:...- ......y......Y..+.t.c .G...5.\.K..........B.m&{.....zi.:. )..T.S.k...o/...U..O...Y?....!...T...O.J

                                                                        C:\Users\user\Downloads\SFPUSAFIOL.docx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.844757314480282
                                                                        Encrypted:false
                                                                        SSDEEP:24:rjDvO+G19yav6Rv/T/3LaGgfGtoSpuEogMvTZpZ77xHZO+tBA0SsYu7kyWbD:XgQ/3T+GgfGoSznMt7NH4qfYdD
                                                                        MD5:14059A3C3B886F8CF3B8A419C8CFC660
                                                                        SHA1:8B5EF533D7DD24286B9976DB1B5B27FF710394F3
                                                                        SHA-256:E88360825E7A352A5991A4939DB2A7CE782E0D920060FD3DB87C141968A31F97
                                                                        SHA-512:8FE120A23B10F9C1407CDD98A8655F0AF0A27ECC54DA86730EC1A92739FDE1497F8C91052C5AAAB07197952AE512E1B36253C0684679DA226B9316E2AB8CDF48
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS+....B&.....%.T...Z..C..@`Td.R^Ez".6mx.(....O.e......h.P..m....a...9(..........ntY0X......k0.2r4.U{....e......].).o.R..`..gZ.V....'k..}....WA.j.uXu...6.w.......1z...l{...r.x.*.."F...d."...,.%......u..=._-.;.M1.0H:..Z.n.....6_umS..).:.......Q w..ySV.C.../...(QQ.z.b.f.../a.....*.df...f.d.e...uz..o..!zh$.1.....mn.4..G.^0..,q...(..n...~....@.<.....q.....O.kZ..m..Ab.<.wZ..#s..........N.C.......C..Y....Nq.ro.q.d..U...M..V.rA~.=~.Y+.P..J{.t.7.g.....;..5>.c.).7....\...Y.7..%..7.~4E...3.&.E........Q)..........Hy.N.H.[..R.duE.>....L.....v.FC..Yv!h{z..,.];.O.C'-..co.....1.b....%y.C..V.<....Y1..i...\?S..Z.lRZ....f....+.VQ.P'(...h...-i.X....e...T..O.z(....'U~....%.6.$!.,c)...%.....`..0JG..PO......c.;..@!F...z..uu..%.@>i....2J...A!L.+..LT....d...C(..R..2.+.!....U..$b*)..<9.&..........D.}..W3.n[<.q`.....N..ca4. P..K..4#.r.Ha......l.QF..<...e.......Z.t*.#..8.R. .;.c.x....q.Zi..H%3..2.g.-..o..../..s}.f.........mV.R..&..?~^.......6Q..`e..j$Z._..%G0

                                                                        C:\Users\user\Downloads\SFPUSAFIOL.docx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.844757314480282
                                                                        Encrypted:false
                                                                        SSDEEP:24:rjDvO+G19yav6Rv/T/3LaGgfGtoSpuEogMvTZpZ77xHZO+tBA0SsYu7kyWbD:XgQ/3T+GgfGoSznMt7NH4qfYdD
                                                                        MD5:14059A3C3B886F8CF3B8A419C8CFC660
                                                                        SHA1:8B5EF533D7DD24286B9976DB1B5B27FF710394F3
                                                                        SHA-256:E88360825E7A352A5991A4939DB2A7CE782E0D920060FD3DB87C141968A31F97
                                                                        SHA-512:8FE120A23B10F9C1407CDD98A8655F0AF0A27ECC54DA86730EC1A92739FDE1497F8C91052C5AAAB07197952AE512E1B36253C0684679DA226B9316E2AB8CDF48
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS+....B&.....%.T...Z..C..@`Td.R^Ez".6mx.(....O.e......h.P..m....a...9(..........ntY0X......k0.2r4.U{....e......].).o.R..`..gZ.V....'k..}....WA.j.uXu...6.w.......1z...l{...r.x.*.."F...d."...,.%......u..=._-.;.M1.0H:..Z.n.....6_umS..).:.......Q w..ySV.C.../...(QQ.z.b.f.../a.....*.df...f.d.e...uz..o..!zh$.1.....mn.4..G.^0..,q...(..n...~....@.<.....q.....O.kZ..m..Ab.<.wZ..#s..........N.C.......C..Y....Nq.ro.q.d..U...M..V.rA~.=~.Y+.P..J{.t.7.g.....;..5>.c.).7....\...Y.7..%..7.~4E...3.&.E........Q)..........Hy.N.H.[..R.duE.>....L.....v.FC..Yv!h{z..,.];.O.C'-..co.....1.b....%y.C..V.<....Y1..i...\?S..Z.lRZ....f....+.VQ.P'(...h...-i.X....e...T..O.z(....'U~....%.6.$!.,c)...%.....`..0JG..PO......c.;..@!F...z..uu..%.@>i....2J...A!L.+..LT....d...C(..R..2.+.!....U..$b*)..<9.&..........D.}..W3.n[<.q`.....N..ca4. P..K..4#.r.Ha......l.QF..<...e.......Z.t*.#..8.R. .;.c.x....q.Zi..H%3..2.g.-..o..../..s}.f.........mV.R..&..?~^.......6Q..`e..j$Z._..%G0

                                                                        C:\Users\user\Downloads\SFPUSAFIOL.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.841004030981119
                                                                        Encrypted:false
                                                                        SSDEEP:24:sbv6Iue44Mr1zOI1sjcmTmxrlHVZlrgcH75v5NpzoaWbD:sbv6s44KqI1RxZH/lrgcH75BNdiD
                                                                        MD5:A837109CB90062DC228B7B081E08593F
                                                                        SHA1:500DC764D1C957AC937B1936886A03BCE27B17F5
                                                                        SHA-256:762AE5B4265D5FE45AFB6856C5655D65AEADE73EE8893209C6287BA16B0F21EA
                                                                        SHA-512:CC2C13D69B5AA48A76D875414764AD0FD7AF8210AA82C9B330B5EA00D207156AC90516A32D819B22A5C679F123670C39A4E861DD8D3DADD624DC3BD7CDB48483
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS.A\......GS#JkYX.".1....Z.b7.:.....Q..|.?z.../....u.u......(....)n.it.)d..XBR.n.....U..n?..M.Z.|nah.k..C. ..[....B.U...JN.V..Q..Nia...*..M{..Q=.&..u.6%.Fk.......Z.#oS..k...>. ..x]........G....g..f....U..=..Q...IH.JQ..9....ore.y.{..d...B..q..J0... ....=c.6....U... ...X1..n.......!.Bl.0..-<.v.f.1.\byk.-.+..kXz.f2s....e.....l....H.K..!.Z<G.....81.....$G............=.../mO.e.fH..m.8t.I.....uN5@@.. .#.?.B.m]......e..ZL.U...R.h..^.....x.x;GM..=N...E.x.S38.(..g.S6...UcU.7.6...O.......fAg..r`9....:.H\.U.f....j}...[%W....b..-.%-....+.#..#...y....+..7Ia@..56/.8.Q.....dI....(k..y.M..l..9E.....$9..).A.#Z.o.6.@..,.) /.M..<E..K..'5.#...R%..Vi..O...Y.....?6...cL..A.e5.u...P......I.9}d...R...6{..S..\#..*...,.-R.X..U.&.$..X....[.......t..9../...M..Z!x.......5....o%8......yn..*j5..8....:{.F.;V...1.....t.U+h.MM.y....I....7..S..>x.X...x..'g-.'...!.....z..............$...../.V3p.k/..'..MTi..P.I..W+......oF.....tV....IlG......<.&..&s.k.0..

                                                                        C:\Users\user\Downloads\SFPUSAFIOL.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.841004030981119
                                                                        Encrypted:false
                                                                        SSDEEP:24:sbv6Iue44Mr1zOI1sjcmTmxrlHVZlrgcH75v5NpzoaWbD:sbv6s44KqI1RxZH/lrgcH75BNdiD
                                                                        MD5:A837109CB90062DC228B7B081E08593F
                                                                        SHA1:500DC764D1C957AC937B1936886A03BCE27B17F5
                                                                        SHA-256:762AE5B4265D5FE45AFB6856C5655D65AEADE73EE8893209C6287BA16B0F21EA
                                                                        SHA-512:CC2C13D69B5AA48A76D875414764AD0FD7AF8210AA82C9B330B5EA00D207156AC90516A32D819B22A5C679F123670C39A4E861DD8D3DADD624DC3BD7CDB48483
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:SFPUS.A\......GS#JkYX.".1....Z.b7.:.....Q..|.?z.../....u.u......(....)n.it.)d..XBR.n.....U..n?..M.Z.|nah.k..C. ..[....B.U...JN.V..Q..Nia...*..M{..Q=.&..u.6%.Fk.......Z.#oS..k...>. ..x]........G....g..f....U..=..Q...IH.JQ..9....ore.y.{..d...B..q..J0... ....=c.6....U... ...X1..n.......!.Bl.0..-<.v.f.1.\byk.-.+..kXz.f2s....e.....l....H.K..!.Z<G.....81.....$G............=.../mO.e.fH..m.8t.I.....uN5@@.. .#.?.B.m]......e..ZL.U...R.h..^.....x.x;GM..=N...E.x.S38.(..g.S6...UcU.7.6...O.......fAg..r`9....:.H\.U.f....j}...[%W....b..-.%-....+.#..#...y....+..7Ia@..56/.8.Q.....dI....(k..y.M..l..9E.....$9..).A.#Z.o.6.@..,.) /.M..<E..K..'5.#...R%..Vi..O...Y.....?6...cL..A.e5.u...P......I.9}d...R...6{..S..\#..*...,.-R.X..U.&.$..X....[.......t..9../...M..Z!x.......5....o%8......yn..*j5..8....:{.F.;V...1.....t.U+h.MM.y....I....7..S..>x.X...x..'g-.'...!.....z..............$...../.V3p.k/..'..MTi..P.I..W+......oF.....tV....IlG......<.&..&s.k.0..

                                                                        C:\Users\user\Downloads\ZQIXMVQGAH.mp3

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8325424392749525
                                                                        Encrypted:false
                                                                        SSDEEP:24:7pV49jekRpxShk6EkkrxhBkNc3YsJUG1twrQjxJYHMUqWbD:7pV0ekaGk8eVJyKrQN+HHXD
                                                                        MD5:8E51518A10CF60954E3DE5735F0939DF
                                                                        SHA1:29D429C33956BFAE68F68AFBC54A8BD69ACDD9FA
                                                                        SHA-256:9086AC10F66F514E0E2486C6C98CB07B5380BA7C7578B67037639BE9F9F5FA2D
                                                                        SHA-512:82CF549B8DE7B48502061E30F18E0875CD85577111891D6867012E5FF74251468562936AF67137B611093DE58DFA3985B1A0AD96747479490120E89630F27331
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMK}..3&.}.D2...c..g.P$.^UQ7".....v6U.....U..FUf.H.E.x..6.f}. .d....."5..R)G...n..T0M./..8.>..*.F.....D...*..W..}q....VHP.Ul1GCJ.D}.$.d_IF.B.P..f..?~:..h...R.(..$Ul."0n.W.]n+...K....:.K/leH..w._@..%..!.VC..a....._P...\....-#....`.....R$...}..sc.!A.../.j.1,>............u..e....K..Pnjp.i..%-....7...F......._<.e.]..um_x.....3.]2(.IU]k.U...C..s..A.G..D,R.[i.:C..~..)C...%...lC...;).c.5\.../...x..6....Kt3.E^. ...L7._......!3../5...joI...).. ...Q'.e7...oN..?..TS..#I.1.....e ...\.\C.e.g.....B...<2.-....ZsL\...A..+.Xt5..<..7.W\u...aE-.......b.....i.......^...cf.'......R=)3.vU6.P...I......=2.."PM.W=....Xm,2.yJ ....!.d9..YY."7.......p....0.Wr...^..iy...y._8..<......5}]B0.`.W...]`....p..._...P...fcO.....*O...F.d.y..S.s.j...X.a..[.3l..._....*H!f....Mq.WV.^..H...%E.h..T.:.]...~yxK.'..'0#..U......'r.v.0..}.p....N.g...c..q...A.6.@Hw8.:.Cy.._CB@....%...n.w..\...x.)=Z....+8.Evq...Q.e...6....|.2..z ,a......-..E.D~...o.._s..{...GB3..r.#..,Zn.SNyi.mG.&

                                                                        C:\Users\user\Downloads\ZQIXMVQGAH.mp3.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.8325424392749525
                                                                        Encrypted:false
                                                                        SSDEEP:24:7pV49jekRpxShk6EkkrxhBkNc3YsJUG1twrQjxJYHMUqWbD:7pV0ekaGk8eVJyKrQN+HHXD
                                                                        MD5:8E51518A10CF60954E3DE5735F0939DF
                                                                        SHA1:29D429C33956BFAE68F68AFBC54A8BD69ACDD9FA
                                                                        SHA-256:9086AC10F66F514E0E2486C6C98CB07B5380BA7C7578B67037639BE9F9F5FA2D
                                                                        SHA-512:82CF549B8DE7B48502061E30F18E0875CD85577111891D6867012E5FF74251468562936AF67137B611093DE58DFA3985B1A0AD96747479490120E89630F27331
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXMK}..3&.}.D2...c..g.P$.^UQ7".....v6U.....U..FUf.H.E.x..6.f}. .d....."5..R)G...n..T0M./..8.>..*.F.....D...*..W..}q....VHP.Ul1GCJ.D}.$.d_IF.B.P..f..?~:..h...R.(..$Ul."0n.W.]n+...K....:.K/leH..w._@..%..!.VC..a....._P...\....-#....`.....R$...}..sc.!A.../.j.1,>............u..e....K..Pnjp.i..%-....7...F......._<.e.]..um_x.....3.]2(.IU]k.U...C..s..A.G..D,R.[i.:C..~..)C...%...lC...;).c.5\.../...x..6....Kt3.E^. ...L7._......!3../5...joI...).. ...Q'.e7...oN..?..TS..#I.1.....e ...\.\C.e.g.....B...<2.-....ZsL\...A..+.Xt5..<..7.W\u...aE-.......b.....i.......^...cf.'......R=)3.vU6.P...I......=2.."PM.W=....Xm,2.yJ ....!.d9..YY."7.......p....0.Wr...^..iy...y._8..<......5}]B0.`.W...]`....p..._...P...fcO.....*O...F.d.y..S.s.j...X.a..[.3l..._....*H!f....Mq.WV.^..H...%E.h..T.:.]...~yxK.'..'0#..U......'r.v.0..}.p....N.g...c..q...A.6.@Hw8.:.Cy.._CB@....%...n.w..\...x.)=Z....+8.Evq...Q.e...6....|.2..z ,a......-..E.D~...o.._s..{...GB3..r.#..,Zn.SNyi.mG.&

                                                                        C:\Users\user\Downloads\ZQIXMVQGAH.pdf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859813264390178
                                                                        Encrypted:false
                                                                        SSDEEP:24:G6/wTnYaKoiE3wmmMt53jTi+qRhFo3VZCgnWBpVe0sdmIk6nwFjMFRrt9bWbD:G6ZBoVzv36zGWXJvIfTrtaD
                                                                        MD5:3B4FCBFD96335F3E77CB2DCA1E1E3EF5
                                                                        SHA1:43CC9191CB4B5F3290939A26FB2324CA61840288
                                                                        SHA-256:1DAF57A79D04CFF9BBEB8CB2B48C6798CBD96859627C46F77E47DB69D9FDD895
                                                                        SHA-512:8B6DD167FA23F4B4E3E888909FD2179E915EA8DE1A11853931AA25E3A04120B014B59FA7E62A2E197E0919312D485D5AE532938E69EF68D9A43ADC407600E513
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM....^45,....R..C^m..<iG.VA.K...]..N.B.b{;[.Z}.Hc.H.j...TA.+.X. ...?.a.q..-.?.V...../..Q..}.I8h....f).....R..H.b...PNqy.....2......<.QMT....L.:2-..VDFp./...I..`....|N.?@lF..P<9..!a..............r3....\.x..z....:.qs..=....:!....e4.qg.=......7.8...2.o#t._...9.d..5.q..m.....z....*."w..c.......6fL.:i..l.|....>..[...^+!$4...K%.Q............|......8'.=..{K.....b.P.}......Y1bU...d\*R?D.m[.v.<.}.Z~s.4.......1. .86ye7.9...'.ZPg...A.s.....[....F*..F.f...P./......1d.."<*W...Uv..e?..N0q.hn..e..V3..'.....2.C....R..3.).Z.....gY..a.c..(.-.Z...+.{3mB......#y.'..(GT.s....)g..T'Su.s..RsBv.a.Z..QY..[K...M...Ykm.b%...5=...d)r..Ii..z<.d......<........f..z.n...6...%.Z..{..].."..1.......%s.4y.R. .7.N(.Ic..J.?..RCZ3.\..-...9na..Nx.Y...A../4....0..1........*.<.$..p-...T........&..Q...@.R.f...F.GP.+..=...cB....V~f....`....4U.;...3..SN*4.....L...-.1.G.)h...._..T5..x.K..._...t..t.....2N.8.jNr......:...U.!.../k3k./.>C....d.}.......B5..uwX<U.~$/..."..(..o.2.h.

                                                                        C:\Users\user\Downloads\ZQIXMVQGAH.pdf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.859813264390178
                                                                        Encrypted:false
                                                                        SSDEEP:24:G6/wTnYaKoiE3wmmMt53jTi+qRhFo3VZCgnWBpVe0sdmIk6nwFjMFRrt9bWbD:G6ZBoVzv36zGWXJvIfTrtaD
                                                                        MD5:3B4FCBFD96335F3E77CB2DCA1E1E3EF5
                                                                        SHA1:43CC9191CB4B5F3290939A26FB2324CA61840288
                                                                        SHA-256:1DAF57A79D04CFF9BBEB8CB2B48C6798CBD96859627C46F77E47DB69D9FDD895
                                                                        SHA-512:8B6DD167FA23F4B4E3E888909FD2179E915EA8DE1A11853931AA25E3A04120B014B59FA7E62A2E197E0919312D485D5AE532938E69EF68D9A43ADC407600E513
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM....^45,....R..C^m..<iG.VA.K...]..N.B.b{;[.Z}.Hc.H.j...TA.+.X. ...?.a.q..-.?.V...../..Q..}.I8h....f).....R..H.b...PNqy.....2......<.QMT....L.:2-..VDFp./...I..`....|N.?@lF..P<9..!a..............r3....\.x..z....:.qs..=....:!....e4.qg.=......7.8...2.o#t._...9.d..5.q..m.....z....*."w..c.......6fL.:i..l.|....>..[...^+!$4...K%.Q............|......8'.=..{K.....b.P.}......Y1bU...d\*R?D.m[.v.<.}.Z~s.4.......1. .86ye7.9...'.ZPg...A.s.....[....F*..F.f...P./......1d.."<*W...Uv..e?..N0q.hn..e..V3..'.....2.C....R..3.).Z.....gY..a.c..(.-.Z...+.{3mB......#y.'..(GT.s....)g..T'Su.s..RsBv.a.Z..QY..[K...M...Ykm.b%...5=...d)r..Ii..z<.d......<........f..z.n...6...%.Z..{..].."..1.......%s.4y.R. .7.N(.Ic..J.?..RCZ3.\..-...9na..Nx.Y...A../4....0..1........*.<.$..p-...T........&..Q...@.R.f...F.GP.+..=...cB....V~f....`....4U.;...3..SN*4.....L...-.1.G.)h...._..T5..x.K..._...t..t.....2N.8.jNr......:...U.!.../k3k./.>C....d.}.......B5..uwX<U.~$/..."..(..o.2.h.

                                                                        C:\Users\user\Downloads\ZQIXMVQGAH.xlsx

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.83387466753782
                                                                        Encrypted:false
                                                                        SSDEEP:24:WnZAzzf8qVicQERZ0aWbSEBUq3UQEYcn/6wkI3XnEWbD:4AzzfOcZ0BS05EtTfpD
                                                                        MD5:F75D2CEEA6CC0C4BEBBD92DDDFECD226
                                                                        SHA1:6557DA2BD3311292DE47BEAACFDC8B74CF5C10CC
                                                                        SHA-256:D0F9939D1A172BE4F19A56BF382967E25A256B03425F31D73AD59AB994884DFB
                                                                        SHA-512:A8660B0893E2FB2B046BE27B62FC50076F792FE5E71F79D9FF844019E015D31842BABB5C27C9EE275C5B9DD2A7965D22FAFA589F2EE6E10BE0AEA0DE31CED0F6
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM*.8eH.......v..../.|..6...t.A..B.}?.f.F...WTb..."...i..1....Y.I...dJK.Hs..{....F..{....L7\p.%;d..P...>@....1$.s0.R.h..c.C.I.;."g y.g.0=."#..S.e....9.f...x.d. .$....u.6....s.r.....]/"%.....#s.~..........B..d....Z...M...FT.....%;...3...I..a.%2&i.m......9.jl..X..oR.....K./.j>..*..\.}........ka.B.I2...p...)^..}88i.)..E.....|.%..............9....K..$..q.HJ..+1yO..d.geD.+.b.....}..-..".....#..n./..G.].....BM..g..|o<*)w.....k0.HX..~.c.{.}.2.9/..pf!.p`;C.b<....}0..z2..U.&.u...f..U.z...8.n.21..1P..% e2:Y.i~....k...%...x.?.(U=.......A..o4....O...hN.........[n.(R...(C[..oEv4t......1BE08.2.X_c........P.\.i..R}>o#..^h;Xu..;].......:m:...t#.h.<.h5.4...D..#.:...D._Aa..u.S..`...v$/...J<..6*.>....-...6q.?Z........K....*T..F...@6.[.9f.u..k....Ls;\#...F.O..ZN.p.!..vV....y]u...n^Sj.m.....P..pX...v.T........,...s.J...#L..$.... v.:u.Km.V..v..>f....Xt.z.....z.BN.....e.*.{.^n.p.G.Z87..8d+..H$..0........]......A..r.!.....S...(.N...|....0.\.....{......P........

                                                                        C:\Users\user\Downloads\ZQIXMVQGAH.xlsx.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1360
                                                                        Entropy (8bit):7.83387466753782
                                                                        Encrypted:false
                                                                        SSDEEP:24:WnZAzzf8qVicQERZ0aWbSEBUq3UQEYcn/6wkI3XnEWbD:4AzzfOcZ0BS05EtTfpD
                                                                        MD5:F75D2CEEA6CC0C4BEBBD92DDDFECD226
                                                                        SHA1:6557DA2BD3311292DE47BEAACFDC8B74CF5C10CC
                                                                        SHA-256:D0F9939D1A172BE4F19A56BF382967E25A256B03425F31D73AD59AB994884DFB
                                                                        SHA-512:A8660B0893E2FB2B046BE27B62FC50076F792FE5E71F79D9FF844019E015D31842BABB5C27C9EE275C5B9DD2A7965D22FAFA589F2EE6E10BE0AEA0DE31CED0F6
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ZQIXM*.8eH.......v..../.|..6...t.A..B.}?.f.F...WTb..."...i..1....Y.I...dJK.Hs..{....F..{....L7\p.%;d..P...>@....1$.s0.R.h..c.C.I.;."g y.g.0=."#..S.e....9.f...x.d. .$....u.6....s.r.....]/"%.....#s.~..........B..d....Z...M...FT.....%;...3...I..a.%2&i.m......9.jl..X..oR.....K./.j>..*..\.}........ka.B.I2...p...)^..}88i.)..E.....|.%..............9....K..$..q.HJ..+1yO..d.geD.+.b.....}..-..".....#..n./..G.].....BM..g..|o<*)w.....k0.HX..~.c.{.}.2.9/..pf!.p`;C.b<....}0..z2..U.&.u...f..U.z...8.n.21..1P..% e2:Y.i~....k...%...x.?.(U=.......A..o4....O...hN.........[n.(R...(C[..oEv4t......1BE08.2.X_c........P.\.i..R}>o#..^h;Xu..;].......:m:...t#.h.<.h5.4...D..#.:...D._Aa..u.S..`...v$/...J<..6*.>....-...6q.?Z........K....*T..F...@6.[.9f.u..k....Ls;\#...F.O..ZN.p.!..vV....y]u...n^Sj.m.....P..pX...v.T........,...s.J...#L..$.... v.:u.Km.V..v..>f....Xt.z.....z.BN.....e.*.{.^n.p.G.Z87..8d+..H$..0........]......A..r.!.....S...(.N...|....0.\.....{......P........

                                                                        C:\Users\user\Favorites\Amazon.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):445
                                                                        Entropy (8bit):7.392425096116155
                                                                        Encrypted:false
                                                                        SSDEEP:12:pteChBMgF/zMkMT2pfVdk0bD+cSeWcii9a:Le8BMA/zBMAb/rSeWbD
                                                                        MD5:4BE4FEE0328854B9E23D27D5206E88A1
                                                                        SHA1:AC0A8D2B19D9ED759BA2B800F963BC1BE31DD28D
                                                                        SHA-256:DDB24E6368EE43F721D2ACA891D4E176A368B73108FABF52613FFA60BA17786F
                                                                        SHA-512:BF6192610284A1EA6889EFD852D56523553E991EBAD6E23DD7DB05B6136595DBB36D9167168C7DA01F0E20076B285BE4E89499040CABAA86EEF236A12E7350AB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..wK.\)Y...4.[..im.+8.....L<..F.).,.N.z..0.'..jb5.&hZ9.....9NA.G..u.9W.;...J...q......{.U..IE...B..R.4..a...]t.t5I.9.M.G8...%O.?.....a.Z....4..#.b..$....B.."%z.O.V.8.;....q"..R..%L.MR/...pGY[.g.e....Omo.x|..q\..l...[+J.Rc.q.U.../.!.Tf!..A..}.ganydV.^W*\b.J.q...L......F.%..g6.8&*.[..}.9,....B.....C.O"'.......j@.L[-.....I.2#.Z./.....b..?.].<..l.&.vylfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Amazon.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):445
                                                                        Entropy (8bit):7.392425096116155
                                                                        Encrypted:false
                                                                        SSDEEP:12:pteChBMgF/zMkMT2pfVdk0bD+cSeWcii9a:Le8BMA/zBMAb/rSeWbD
                                                                        MD5:4BE4FEE0328854B9E23D27D5206E88A1
                                                                        SHA1:AC0A8D2B19D9ED759BA2B800F963BC1BE31DD28D
                                                                        SHA-256:DDB24E6368EE43F721D2ACA891D4E176A368B73108FABF52613FFA60BA17786F
                                                                        SHA-512:BF6192610284A1EA6889EFD852D56523553E991EBAD6E23DD7DB05B6136595DBB36D9167168C7DA01F0E20076B285BE4E89499040CABAA86EEF236A12E7350AB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..wK.\)Y...4.[..im.+8.....L<..F.).,.N.z..0.'..jb5.&hZ9.....9NA.G..u.9W.;...J...q......{.U..IE...B..R.4..a...]t.t5I.9.M.G8...%O.?.....a.Z....4..#.b..$....B.."%z.O.V.8.;....q"..R..%L.MR/...pGY[.g.e....Omo.x|..q\..l...[+J.Rc.q.U.../.!.Tf!..A..}.ganydV.^W*\b.J.q...L......F.%..g6.8&*.[..}.9,....B.....C.O"'.......j@.L[-.....I.2#.Z./.....b..?.].<..l.&.vylfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Bing.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):542
                                                                        Entropy (8bit):7.575242085416927
                                                                        Encrypted:false
                                                                        SSDEEP:12:IZr6B8FlRLT4kqb+YMbYNXQfuYM6RsWcii9a:IZr6eFlUhFNXwaisWbD
                                                                        MD5:F65AFA07C603C926BE07337E2A2DB9D5
                                                                        SHA1:9CE90908C156B35D78E8805B0C63F693FABE2C3C
                                                                        SHA-256:A7DCC9989EC01CCD6E13431701BC288BEF0D7CD56EFF0FDD8B2C8293CA32EAB5
                                                                        SHA-512:3D0542375611371C058E1B73893C552668E17367F5F03B75177CF9A6FF435B601BFDFCB69782779B235A1FA9C939E4CDBE2C21DC407F579AB040C294EF4E191F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..<Ie.S.[~...c.Fv@.#...y.. ..4...ks....~..o3.T_go.......J.3..jj.P.>-.^.b..A/................=...*..,g.f....P4O.?.....G...,.0...M`9..8. .ugZG.....<....T..HZ"z.....ke.z...#].@~...=|'Cq..N.....%..[PS-.P.)!..P..C...bu.......l.k*.z...I....kB..=c...&.......B...E....Cw....u..)O5...3.#....5.._.Q(...1..hr...#.v..K...u...;....q.R....,`....vV}.....W...8..b..].z.`.g.Z....#.........6.A....l..a.j.-.d(zu$]HxK.q2h,.L.W.q.I..ksCXMo.S...d..."O.$lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Bing.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):542
                                                                        Entropy (8bit):7.575242085416927
                                                                        Encrypted:false
                                                                        SSDEEP:12:IZr6B8FlRLT4kqb+YMbYNXQfuYM6RsWcii9a:IZr6eFlUhFNXwaisWbD
                                                                        MD5:F65AFA07C603C926BE07337E2A2DB9D5
                                                                        SHA1:9CE90908C156B35D78E8805B0C63F693FABE2C3C
                                                                        SHA-256:A7DCC9989EC01CCD6E13431701BC288BEF0D7CD56EFF0FDD8B2C8293CA32EAB5
                                                                        SHA-512:3D0542375611371C058E1B73893C552668E17367F5F03B75177CF9A6FF435B601BFDFCB69782779B235A1FA9C939E4CDBE2C21DC407F579AB040C294EF4E191F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..<Ie.S.[~...c.Fv@.#...y.. ..4...ks....~..o3.T_go.......J.3..jj.P.>-.^.b..A/................=...*..,g.f....P4O.?.....G...,.0...M`9..8. .ugZG.....<....T..HZ"z.....ke.z...#].@~...=|'Cq..N.....%..[PS-.P.)!..P..C...bu.......l.k*.z...I....kB..=c...&.......B...E....Cw....u..)O5...3.#....5.._.Q(...1..hr...#.v..K...u...;....q.R....,`....vV}.....W...8..b..].z.`.g.Z....#.........6.A....l..a.j.-.d(zu$]HxK.q2h,.L.W.q.I..ksCXMo.S...d..."O.$lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Facebook.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):447
                                                                        Entropy (8bit):7.444162986689331
                                                                        Encrypted:false
                                                                        SSDEEP:12:+FGk7PJW0SAV1FDEvgAQv44TGdOv7vWcii9a:KhZZ1F664rsbWbD
                                                                        MD5:C0859A6512A3263811458CA313EF1672
                                                                        SHA1:E1344E8F3488257F13011CE7C02F985C2A641C48
                                                                        SHA-256:F511EDC5A5FBE3012F6D176413DB03B100FFAF47B825AE283E7CBAAB9D6E66D5
                                                                        SHA-512:447A1F65717B5232F8299CD4C49FBADECCF8BC10F3DE754C434902A46D2EBEA80C7B51968655A18E86A6945C3A6161762B2047756090C19ACFE85772B2DBFBC2
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000....[.gW....i5.t.-HR...0F.O.].&.l...ti.../..mY....."..l.-. ,.f[...oK.N...)....?.Z....\.6......IY&o.....w...gUn..i...1w..:R..^....&....^..@N.hV.?..G.R...[1.0..G. .:..(.J#(...Il.9..v..X.1....u.v....5..G,..q57.u............PAtR6...B....<.........A....Bj..4..[..8.`.v.....Z......Q..h0..|....a..]...&..K...'..u._I..=G6M>.f>.#.8.6D8.*.......JS0"....6mlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Facebook.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):447
                                                                        Entropy (8bit):7.444162986689331
                                                                        Encrypted:false
                                                                        SSDEEP:12:+FGk7PJW0SAV1FDEvgAQv44TGdOv7vWcii9a:KhZZ1F664rsbWbD
                                                                        MD5:C0859A6512A3263811458CA313EF1672
                                                                        SHA1:E1344E8F3488257F13011CE7C02F985C2A641C48
                                                                        SHA-256:F511EDC5A5FBE3012F6D176413DB03B100FFAF47B825AE283E7CBAAB9D6E66D5
                                                                        SHA-512:447A1F65717B5232F8299CD4C49FBADECCF8BC10F3DE754C434902A46D2EBEA80C7B51968655A18E86A6945C3A6161762B2047756090C19ACFE85772B2DBFBC2
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000....[.gW....i5.t.-HR...0F.O.].&.l...ti.../..mY....."..l.-. ,.f[...oK.N...)....?.Z....\.6......IY&o.....w...gUn..i...1w..:R..^....&....^..@N.hV.?..G.R...[1.0..G. .:..(.J#(...Il.9..v..X.1....u.v....5..G,..q57.u............PAtR6...B....<.........A....Bj..4..[..8.`.v.....Z......Q..h0..|....a..]...&..K...'..u._I..=G6M>.f>.#.8.6D8.*.......JS0"....6mlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Google.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):445
                                                                        Entropy (8bit):7.413795377024758
                                                                        Encrypted:false
                                                                        SSDEEP:12:EaEQ6QyFUxyNxinAtAtkKP06NOKrwWcii9a:NEQ6QJxyiAtAtkQ06rUWbD
                                                                        MD5:9A2F4F0BF28AFD9A26838D08A63FD453
                                                                        SHA1:6794CD00404DB1042FA315BA524668A9CF0640EA
                                                                        SHA-256:BFEB25946EFCDF216900920BAB193EE891ED364E1AEE7639400A6390DF1C6AA7
                                                                        SHA-512:E64AE3DF82B4896C70E4F33C4833B322F94A013DD81EFADE05F672092272A41EE71044C922DA7F0AA8C9D21E256D8AC9268E30542624A4DBFDFE6903D6CE55B1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000 ...KM^*.R..2......#AP....i...E.o..Y^=...KpFI......\.K.5.X...G..O.....u..<.........z..j...U...x:7bQ....{d..t..<...%5..P..k.M.;5imV%.o..2O....}.+.......j.nM:...........br.G=.Gr!.=!2MA.%......v9..0...yl%.?2......a...0Y.Fn......b....y..zB....{.........9...:f3.yr\.b-...ec....7.....>..br..Hu..@.-......K....#{2Z.*.....'....j..2g...P...K....lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Google.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):445
                                                                        Entropy (8bit):7.413795377024758
                                                                        Encrypted:false
                                                                        SSDEEP:12:EaEQ6QyFUxyNxinAtAtkKP06NOKrwWcii9a:NEQ6QJxyiAtAtkQ06rUWbD
                                                                        MD5:9A2F4F0BF28AFD9A26838D08A63FD453
                                                                        SHA1:6794CD00404DB1042FA315BA524668A9CF0640EA
                                                                        SHA-256:BFEB25946EFCDF216900920BAB193EE891ED364E1AEE7639400A6390DF1C6AA7
                                                                        SHA-512:E64AE3DF82B4896C70E4F33C4833B322F94A013DD81EFADE05F672092272A41EE71044C922DA7F0AA8C9D21E256D8AC9268E30542624A4DBFDFE6903D6CE55B1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000 ...KM^*.R..2......#AP....i...E.o..Y^=...KpFI......\.K.5.X...G..O.....u..<.........z..j...U...x:7bQ....{d..t..<...%5..P..k.M.;5imV%.o..2O....}.+.......j.nM:...........br.G=.Gr!.=!2MA.%......v9..0...yl%.?2......a...0Y.Fn......b....y..zB....{.........9...:f3.yr\.b-...ec....7.....>..br..Hu..@.-......K....#{2Z.*.....'....j..2g...P...K....lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Live.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):443
                                                                        Entropy (8bit):7.409261714191966
                                                                        Encrypted:false
                                                                        SSDEEP:12:2evT+RaRXkwI5xKz5CeRNDZ+Rok8g1Wcii9a:t6RuTwE5CeRNgz8cWbD
                                                                        MD5:4C932D2410C0F50C7454CFD835171BE7
                                                                        SHA1:417C12E4DED58A5EDFBE08C06E27DD5426BAFEA0
                                                                        SHA-256:1C2C55A95456AF135E8BED022B2B1BFCF5F9F98FF1ED3529B68B329D1C0D5C01
                                                                        SHA-512:CA4E3E5713340FD5447E6608409912BD0CF417C2B43168F4A398F7AA1D588DA4685DB6A0A67E0AA54F9218D93C9E4963E6262CB4F5CF660B4CF6630A7303E2A8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..H.I.....u.....j...Y..5:.........%}A......M.`.B...T>.hmW. .....<...0DJ0.{^a.o7W.?...Q}.....J.......@.uJW#g...+k.I.r...._...'...n.we[%.._....LW..2[..}.....h....U...z.Ie...,J...O.t.z.....A.<h.p.T'LK...7.`.cY..n..}B~xd|W...9r..0.l*K..T7Q#m.>.<...2X..v.Q..E.QU.....:..T.%..rf........W.y..F2.C......O...s?[.t&...x.$..5|.B6..lZO...X..!.^......z.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Live.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):443
                                                                        Entropy (8bit):7.409261714191966
                                                                        Encrypted:false
                                                                        SSDEEP:12:2evT+RaRXkwI5xKz5CeRNDZ+Rok8g1Wcii9a:t6RuTwE5CeRNgz8cWbD
                                                                        MD5:4C932D2410C0F50C7454CFD835171BE7
                                                                        SHA1:417C12E4DED58A5EDFBE08C06E27DD5426BAFEA0
                                                                        SHA-256:1C2C55A95456AF135E8BED022B2B1BFCF5F9F98FF1ED3529B68B329D1C0D5C01
                                                                        SHA-512:CA4E3E5713340FD5447E6608409912BD0CF417C2B43168F4A398F7AA1D588DA4685DB6A0A67E0AA54F9218D93C9E4963E6262CB4F5CF660B4CF6630A7303E2A8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..H.I.....u.....j...Y..5:.........%}A......M.`.B...T>.hmW. .....<...0DJ0.{^a.o7W.?...Q}.....J.......@.uJW#g...+k.I.r...._...'...n.we[%.._....LW..2[..}.....h....U...z.Ie...,J...O.t.z.....A.<h.p.T'LK...7.`.cY..n..}B~xd|W...9r..0.l*K..T7Q#m.>.<...2X..v.Q..E.QU.....:..T.%..rf........W.y..F2.C......O...s?[.t&...x.$..5|.B6..lZO...X..!.^......z.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\NYTimes.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):446
                                                                        Entropy (8bit):7.397387619939119
                                                                        Encrypted:false
                                                                        SSDEEP:12:oD4T4BFp60Q0c3KSzJQ3+QNBm9YKVa1u5Wcii9a:oy4BFpo0uKSOuQ8YKVaQ5WbD
                                                                        MD5:4AB36F7CEDC63494636C7EC088DA4260
                                                                        SHA1:D68E54872E1904B0B0422B2ECD66B15F91E5C508
                                                                        SHA-256:521A32A03862889FD562F2571C53E5185BC744B9F3E90AAE175D7C6F9BCA74E1
                                                                        SHA-512:88B54EFECC54B54F6CCF39D1C53BCFA753FF3606495F4FA1DFE0620A9DE67CCF46BD535AB4CF1E9968232E42AD69BC8F0F8ED8F9E1386CAC8EA55BE35B9AA6A5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000.%........$.X.}.s^...>...C*...O..|k..tM.]....|X.8.e..[.o{....69g{F...WE...3s[w+.2..K..:...yj.8N..rO.hy.E3b_.....6.Q..{;...cK..2(.q...y.i...mP......Q..T.d!~.5.7T.l.kw...7.)..[..<4.Ax...>.#.P......@.....s..0.x.(9.W3..F.0O.YR].qh...3z...B....2....w.d.sW..AY.GmB......07..X.-m8j/.EQ.*.......n@.^.Ve..)ca.QJ.e.......N.....j...RKQ. Z.\..2...>.K.y..Z..,_q.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\NYTimes.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):446
                                                                        Entropy (8bit):7.397387619939119
                                                                        Encrypted:false
                                                                        SSDEEP:12:oD4T4BFp60Q0c3KSzJQ3+QNBm9YKVa1u5Wcii9a:oy4BFpo0uKSOuQ8YKVaQ5WbD
                                                                        MD5:4AB36F7CEDC63494636C7EC088DA4260
                                                                        SHA1:D68E54872E1904B0B0422B2ECD66B15F91E5C508
                                                                        SHA-256:521A32A03862889FD562F2571C53E5185BC744B9F3E90AAE175D7C6F9BCA74E1
                                                                        SHA-512:88B54EFECC54B54F6CCF39D1C53BCFA753FF3606495F4FA1DFE0620A9DE67CCF46BD535AB4CF1E9968232E42AD69BC8F0F8ED8F9E1386CAC8EA55BE35B9AA6A5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000.%........$.X.}.s^...>...C*...O..|k..tM.]....|X.8.e..[.o{....69g{F...WE...3s[w+.2..K..:...yj.8N..rO.hy.E3b_.....6.Q..{;...cK..2(.q...y.i...mP......Q..T.d!~.5.7T.l.kw...7.)..[..<4.Ax...>.#.P......@.....s..0.x.(9.W3..F.0O.YR].qh...3z...B....2....w.d.sW..AY.GmB......07..X.-m8j/.EQ.*.......n@.^.Ve..)ca.QJ.e.......N.....j...RKQ. Z.\..2...>.K.y..Z..,_q.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Reddit.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):445
                                                                        Entropy (8bit):7.376244142059506
                                                                        Encrypted:false
                                                                        SSDEEP:12:tSKTCjLnHXXMEfb8e2Z5MirElJIpJorWcii9a:R2jTnLbtmqJIAWbD
                                                                        MD5:38E58E04D5043FFC296887604CDE8E54
                                                                        SHA1:567DF8537EC892A38005AA8F6F7609B4ABADD53A
                                                                        SHA-256:9B2229557F5F58100AB541971F540FA5A829BBBC34C753884E2469B0DC19FDD5
                                                                        SHA-512:C2744259D225A4CF97F61739E92AC743236B6D2602812D2C6987C9F8C7FE980B81D26BB2E668A72BBBF2DE9E35959D8F97C29E819518616BCECA34B232FF7EA9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..7...7..f./#||&..(.../...,..9f.\.....^.....WE.{@..V`..dt".-...$(2..a.t$p.B...k|g.ET..o.e....B....l9..J..t}........).9C....9E..z./.L.u6l..f.9.....YQ..z.d....<`J>*.k...G.._.......KV.m..B...F..i.,.......R..a..e p.......8qm....k;.=7......Z....Ci.A^.v.....;.`.6o.ro.(.....!|]......J..}._..k.1Bw...d.T..?.,y4x..Ct.P&...q..t..A..4...".f..<..lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Reddit.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):445
                                                                        Entropy (8bit):7.376244142059506
                                                                        Encrypted:false
                                                                        SSDEEP:12:tSKTCjLnHXXMEfb8e2Z5MirElJIpJorWcii9a:R2jTnLbtmqJIAWbD
                                                                        MD5:38E58E04D5043FFC296887604CDE8E54
                                                                        SHA1:567DF8537EC892A38005AA8F6F7609B4ABADD53A
                                                                        SHA-256:9B2229557F5F58100AB541971F540FA5A829BBBC34C753884E2469B0DC19FDD5
                                                                        SHA-512:C2744259D225A4CF97F61739E92AC743236B6D2602812D2C6987C9F8C7FE980B81D26BB2E668A72BBBF2DE9E35959D8F97C29E819518616BCECA34B232FF7EA9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..7...7..f./#||&..(.../...,..9f.\.....^.....WE.{@..V`..dt".-...$(2..a.t$p.B...k|g.ET..o.e....B....l9..J..t}........).9C....9E..z./.L.u6l..f.9.....YQ..z.d....<`J>*.k...G.._.......KV.m..B...F..i.,.......R..a..e p.......8qm....k;.=7......Z....Ci.A^.v.....;.`.6o.ro.(.....!|]......J..}._..k.1Bw...d.T..?.,y4x..Ct.P&...q..t..A..4...".f..<..lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Twitter.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):446
                                                                        Entropy (8bit):7.468609107544574
                                                                        Encrypted:false
                                                                        SSDEEP:12:m1tiR4aET/sAiosKLYTh9E9CsX2PWcii9a:03T/4FKG1WbD
                                                                        MD5:3E0CCF33CAE47FB59ADC033526CC3473
                                                                        SHA1:549BD047FE5AE5DFF04CC947933FC8F0407D8522
                                                                        SHA-256:36F9080FB6DD615E0E14BD9D09E2206F806D135B59771F50405E15464B425933
                                                                        SHA-512:80E04E5F6828C14CCC656C00E49F089E0DD3A4494C353ABC06549A5F1B1C5AB8DE94B32AE4382F9257EF79DF8C718AFE1A09AF2940829DEBA86F96372F046AB6
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000...5.....G......h...<...v..E.....G.n.....E:.....I..>...c....1X.7).,]5.9... 7.P..7..)..^.2.....h..p...M....Gy...fNK....(.x.....V#.jf..$.Y'.:..6......5...J.P(%n.}8+.0.;..7!.....M....C8..aV..t,..s..BAXnaLd.D'.......Z...a..&.i2....aBd.".V....= .V)0..S6o.zW~Ev...).R}b....$$.....u.(..Z...4....'...:...Z..'exD.d..;.6.bQg NO...R..<.'.I..k..0...1..9r.>R."lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Twitter.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):446
                                                                        Entropy (8bit):7.468609107544574
                                                                        Encrypted:false
                                                                        SSDEEP:12:m1tiR4aET/sAiosKLYTh9E9CsX2PWcii9a:03T/4FKG1WbD
                                                                        MD5:3E0CCF33CAE47FB59ADC033526CC3473
                                                                        SHA1:549BD047FE5AE5DFF04CC947933FC8F0407D8522
                                                                        SHA-256:36F9080FB6DD615E0E14BD9D09E2206F806D135B59771F50405E15464B425933
                                                                        SHA-512:80E04E5F6828C14CCC656C00E49F089E0DD3A4494C353ABC06549A5F1B1C5AB8DE94B32AE4382F9257EF79DF8C718AFE1A09AF2940829DEBA86F96372F046AB6
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000...5.....G......h...<...v..E.....G.n.....E:.....I..>...c....1X.7).,]5.9... 7.P..7..)..^.2.....h..p...M....Gy...fNK....(.x.....V#.jf..$.Y'.:..6......5...J.P(%n.}8+.0.;..7!.....M....C8..aV..t,..s..BAXnaLd.D'.......Z...a..&.i2....aBd.".V....= .V)0..S6o.zW~Ev...).R}b....$$.....u.(..Z...4....'...:...Z..'exD.d..;.6.bQg NO...R..<.'.I..k..0...1..9r.>R."lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Wikipedia.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):448
                                                                        Entropy (8bit):7.435483468224188
                                                                        Encrypted:false
                                                                        SSDEEP:12:2+0RombzboAZfZXGyBZeDnmoW66lWcii9a:24aMKhRZsy6sWbD
                                                                        MD5:59937766F1E288320C6A6A4B6DEC2FE1
                                                                        SHA1:2B4C5013CAC0ACCA3A95ADA130191BE7552F439E
                                                                        SHA-256:2A7B4FB121076B713B2B2C3665B42A3F5AD97695FE49147BA0C7DA90478BED4D
                                                                        SHA-512:C91E67C1CF61E24CBED834BAB889A05534A14AB0585BBCC93DC616F57A7AE47C70B4B2B85F3E5E510402278398F012219A71DECFD7944B06B9A3B8A6CFB38FB5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..;h.{O...;.&.=.6..rX(...n.......9...3.W..\..z..).|Z..^vv..m...q..824.....S../.]W(..<.............;....R.....v..-...>.!.{i!.....7~..;..Z.j.....lRG...x.e....\]o.{AS.s.x."..@M...q.^.0x.^....i.8...<k`/,`....j.2..!VW.J*o=.....C....k...cM|..K.at....G......;Qx.`.......)_.Zm.....{.......*=.....@......L.W".w{Q....>Q..6...t=[~1t.>.1.o.R..../i.B.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Wikipedia.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):448
                                                                        Entropy (8bit):7.435483468224188
                                                                        Encrypted:false
                                                                        SSDEEP:12:2+0RombzboAZfZXGyBZeDnmoW66lWcii9a:24aMKhRZsy6sWbD
                                                                        MD5:59937766F1E288320C6A6A4B6DEC2FE1
                                                                        SHA1:2B4C5013CAC0ACCA3A95ADA130191BE7552F439E
                                                                        SHA-256:2A7B4FB121076B713B2B2C3665B42A3F5AD97695FE49147BA0C7DA90478BED4D
                                                                        SHA-512:C91E67C1CF61E24CBED834BAB889A05534A14AB0585BBCC93DC616F57A7AE47C70B4B2B85F3E5E510402278398F012219A71DECFD7944B06B9A3B8A6CFB38FB5
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000..;h.{O...;.&.=.6..rX(...n.......9...3.W..\..z..).|Z..^vv..m...q..824.....S../.]W(..<.............;....R.....v..-...>.!.{i!.....7~..;..Z.j.....lRG...x.e....\]o.{AS.s.x."..@M...q.^.0x.^....i.8...<k`/,`....j.2..!VW.J*o=.....C....k...cM|..K.at....G......;Qx.`.......)_.Zm.....{.......*=.....@......L.W".w{Q....>Q..6...t=[~1t.>.1.o.R..../i.B.lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Youtube.url

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):446
                                                                        Entropy (8bit):7.420548144765941
                                                                        Encrypted:false
                                                                        SSDEEP:12:LCuqSOr+wvA1e5Cy/22+XWkUTD1gE2hP+Wcii9a:LCutAA1iqWkUHpgWWbD
                                                                        MD5:63FF23CF7C3A1A62583B051833175365
                                                                        SHA1:086C0906D5F96B5AF28FE109DCA400C1635C85D1
                                                                        SHA-256:E4A50074F582094FFF71C70A2B20A7E4584DA0FD526F83351BD31363D706CA92
                                                                        SHA-512:69B458B1410266EF00EFF3FFC311305C25C9D1405BB1F936BCB1F6C7B305A7C357B32E3BFB089B56044B7685326214D8C58895899E4782FCEFA6257E4C33A624
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000s\........viK.}h..c..9Q.{.n......7.=.G..?(.D......(....n..K6.J<,....h.y...9...Y.;..}q. .4,.x.-c'.....l./...03}pOe.{.M'.nS...Ay..f....lO....?A.f......7..OJ.b.;$.z..F`....U....l*...w..U...ZV......@2R(.e?.......QA..DP....iU3\e..v...S.EI..3......cy..>..$+.0.k~...oi...xSQ.(fb..x.......$..;...{f....._..l.e....ye;]..Q?.~..0.qe.=.zK.......oL..N.^g...^mlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Favorites\Youtube.url.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):446
                                                                        Entropy (8bit):7.420548144765941
                                                                        Encrypted:false
                                                                        SSDEEP:12:LCuqSOr+wvA1e5Cy/22+XWkUTD1gE2hP+Wcii9a:LCutAA1iqWkUHpgWWbD
                                                                        MD5:63FF23CF7C3A1A62583B051833175365
                                                                        SHA1:086C0906D5F96B5AF28FE109DCA400C1635C85D1
                                                                        SHA-256:E4A50074F582094FFF71C70A2B20A7E4584DA0FD526F83351BD31363D706CA92
                                                                        SHA-512:69B458B1410266EF00EFF3FFC311305C25C9D1405BB1F936BCB1F6C7B305A7C357B32E3BFB089B56044B7685326214D8C58895899E4782FCEFA6257E4C33A624
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:[{000s\........viK.}h..c..9Q.{.n......7.=.G..?(.D......(....n..K6.J<,....h.y...9...Y.;..}q. .4,.x.-c'.....l./...03}pOe.{.M'.nS...Ay..f....lO....?A.f......7..OJ.b.;$.z..F`....U....l*...w..U...ZV......@2R(.e?.......QA..DP....iU3\e..v...S.EI..3......cy..>..$+.0.k~...oi...xSQ.(fb..x.......$..;...{f....._..l.e....ye;]..Q?.~..0.qe.=.zK.......oL..N.^g...^mlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Pictures\0EM9MRJYNgaQ4VquhLvMZCs2.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\18TZ4GlEcXROaMlzQyxlot37.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\Pictures\1oYHJ3b1F3QrpZXBIXgl6loz.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\Pictures\2OoGOAjocmnrCO0Kg3mdJjGT.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\3Q13EXxFz2FZ8WAMgsOWhK6Y.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\3zaREjkJ8eT5V6QYRyuztw7a.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\46ajs7POqByEYUKIKWz4ttVU.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\4DWY8TXKZwukDUa94C0KWFj4.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\Pictures\4b20TTfioBavoCXVhZH8FlIL.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\Pictures\8XubnCv1993Zn4FRUL2X67x0.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\9fmETiwrp9mvcT9QPdRrgON5.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\Pictures\Ba6UF83A2hR7tzyyn3dRNO2C.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\C88Sh505pu9bIEkUIPtIAuGY.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):2904262
                                                                        Entropy (8bit):7.7915712768286
                                                                        Encrypted:false
                                                                        SSDEEP:49152:nllYwK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4v+:nllYwrGHip8nfzyeJaipzW88gLv+
                                                                        MD5:D816DDCD4E49FCBF39013C6C623EB676
                                                                        SHA1:F1F84EBB6F678FCF7E4E68CAC75018B2F8C909DF
                                                                        SHA-256:766F0DA9EC43B9AD339FAC64C1DA21E1E9DD5D49018A7EB65FA62145FA720C62
                                                                        SHA-512:31D40D8EC34C5D50399DEDB43CA2ECD19C94460CCD2C3A57D6B9BFD6E3FAB65FACB85B093A30EC7B9E7F0A7A24DA914CA0D9C1ABE40843421C624C23B36347B2
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx......JeHa(..i.r-j.:{...T{...Q..~.)...uw.....VS.P.L..-....s.'..g....JX.*..XT..6......W..7..o..eS...e.A..9.d..J.9o...8/.e.2q..R..>...-=......Xb..Spx,..x6.....G|.F..l..j.T.'.....G...Ec..Bt0..nG.......2......+....G.,p...C6.w.p[...^.....%Q.i..f..sc.....[\.f..=..%C.i..|o..'lA...z...E..X.bz.PFem#0k.&.M..;6V...Qj...+/:j).V`....={.@/t..f.z..|.h..<fT.v&'..Iq...$...@+.....o...K.G..@........wXL=..*{.'......9...g.EM.......>J./..[Ez....l}d.P....F..`.._...F....e.Y.W..o...h.....X.~GI...y.+z>.$...Dp..)-ul:.....At.]g.X...j.u.u.z...T.w.j..w.x.....h...W)W{.y...x.[ ..pKI.......y..HwN.\.}Z'...U....\M#R87{.!..qiH..A.).k......L.W..Y...T..r6..~..S.OK.O ..b...@^2....GI.N;x.Qe.DV.&.R..{#.D...v..B..<w..!,u.k,.......D...j>.^...q{..C\..jE..T....{......D...>..j.2...~.....].eDe.:..S.t.W...g.c...\.]3..l.=..i!.~.Hl.......N&...@....bv"J...z78$5....xi.!..U..U...4P .F.qcZ...X^.M.v..#.9....R.o..{R..d......9.......l......Hs.$..T....M.._.9....Y[{.,s...h.. ..`......w...t.C.)3]"...'N,..c

                                                                        C:\Users\user\Pictures\C88Sh505pu9bIEkUIPtIAuGY.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):2904262
                                                                        Entropy (8bit):7.7915712768286
                                                                        Encrypted:false
                                                                        SSDEEP:49152:nllYwK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4v+:nllYwrGHip8nfzyeJaipzW88gLv+
                                                                        MD5:D816DDCD4E49FCBF39013C6C623EB676
                                                                        SHA1:F1F84EBB6F678FCF7E4E68CAC75018B2F8C909DF
                                                                        SHA-256:766F0DA9EC43B9AD339FAC64C1DA21E1E9DD5D49018A7EB65FA62145FA720C62
                                                                        SHA-512:31D40D8EC34C5D50399DEDB43CA2ECD19C94460CCD2C3A57D6B9BFD6E3FAB65FACB85B093A30EC7B9E7F0A7A24DA914CA0D9C1ABE40843421C624C23B36347B2
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx......JeHa(..i.r-j.:{...T{...Q..~.)...uw.....VS.P.L..-....s.'..g....JX.*..XT..6......W..7..o..eS...e.A..9.d..J.9o...8/.e.2q..R..>...-=......Xb..Spx,..x6.....G|.F..l..j.T.'.....G...Ec..Bt0..nG.......2......+....G.,p...C6.w.p[...^.....%Q.i..f..sc.....[\.f..=..%C.i..|o..'lA...z...E..X.bz.PFem#0k.&.M..;6V...Qj...+/:j).V`....={.@/t..f.z..|.h..<fT.v&'..Iq...$...@+.....o...K.G..@........wXL=..*{.'......9...g.EM.......>J./..[Ez....l}d.P....F..`.._...F....e.Y.W..o...h.....X.~GI...y.+z>.$...Dp..)-ul:.....At.]g.X...j.u.u.z...T.w.j..w.x.....h...W)W{.y...x.[ ..pKI.......y..HwN.\.}Z'...U....\M#R87{.!..qiH..A.).k......L.W..Y...T..r6..~..S.OK.O ..b...@^2....GI.N;x.Qe.DV.&.R..{#.D...v..B..<w..!,u.k,.......D...j>.^...q{..C\..jE..T....{......D...>..j.2...~.....].eDe.:..S.t.W...g.c...\.]3..l.=..i!.~.Hl.......N&...@....bv"J...z78$5....xi.!..U..U...4P .F.qcZ...X^.M.v..#.9....R.o..{R..d......9.......l......Hs.$..T....M.._.9....Y[{.,s...h.. ..`......w...t.C.)3]"...'N,..c

                                                                        C:\Users\user\Pictures\CxjHTt9L9FL0XO680gDmLj9t.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\DuDMa6rOf5SGixuVkls53BX0.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):4402382
                                                                        Entropy (8bit):7.947545478385459
                                                                        Encrypted:false
                                                                        SSDEEP:98304:4Kw96pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glN:DpBNW91wVrN36e+uJiPlN
                                                                        MD5:FA917CC4F133B3A9E1EA05F6D1F70888
                                                                        SHA1:E4EB7468C57518A887F2E4FD0361B26C77EE7A22
                                                                        SHA-256:389D2523AA6362A36BEC4F1F46681CD3319F3DB34C63799AD0AA3D3D733A45DB
                                                                        SHA-512:19C565BD0E142032770DC33334A507FD47B6CCDCB4897F1771C391A8692E5C3869607A5E5BAD16CACF785D03877DE604610A051476814235F0BE65FC24F9200F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ....g..T..).....?.MkJ.o..7......K.-........Z....".\=f$..........u*...~*..8..k.9../j.C(c...(..e.T...d../-q.q....D'E.l@.~.....[..Q,m.g........z..R...s.T....(c..k..$p.L.N.E.."...=.5;.S.V2.^.o...1....8....c6X...M....-<ql..x....AaR..o:._.[fm..r..]...........8.....&..J..be.....+(.........E>O_.\...<dmp..;K.E....i...../..B....+8...l.....?..J...YFh+.N2.r.J.ku...lj.+`simO;..c`..JnR.3...=....#...f\K|.2.T...=A.z.A.......{M`.....ao.._KHL..T&..[......%..$.k.. Q..@n.\...#_5mT(5..u=.m.{...B.RC.rQ...D..V9...&{`..t.V-`G.i.Pd.'2...sP.....R~...xK>..........z..)..%T..2.7...^.I$....VbS.UU.,p$.<N.pcNo..*Yi9..%.Q.@U.........Y.n....W..F...J.."@.#?.....A..5.f.F-..;.r..h."*A...`g'.l.aK..j..3.....w..G(.............u.Y.a.;J;O'.!E...x...p<..1b..V...}CrK..b.QZ`..K...R."...Kq....'.{."....G...?.".Bc..i.\h...~.....LV:U ....iL.*W^Mp..~!....D.w.....C&...r..`S..z..}..=zM..%D..B..Cp....U.....+Xb..2[...=..(...8R37.....I.w@...P.).3.g...0..x...5...J..F$..2X...u..1..2..]....

                                                                        C:\Users\user\Pictures\DuDMa6rOf5SGixuVkls53BX0.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):4402382
                                                                        Entropy (8bit):7.947545478385459
                                                                        Encrypted:false
                                                                        SSDEEP:98304:4Kw96pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glN:DpBNW91wVrN36e+uJiPlN
                                                                        MD5:FA917CC4F133B3A9E1EA05F6D1F70888
                                                                        SHA1:E4EB7468C57518A887F2E4FD0361B26C77EE7A22
                                                                        SHA-256:389D2523AA6362A36BEC4F1F46681CD3319F3DB34C63799AD0AA3D3D733A45DB
                                                                        SHA-512:19C565BD0E142032770DC33334A507FD47B6CCDCB4897F1771C391A8692E5C3869607A5E5BAD16CACF785D03877DE604610A051476814235F0BE65FC24F9200F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ....g..T..).....?.MkJ.o..7......K.-........Z....".\=f$..........u*...~*..8..k.9../j.C(c...(..e.T...d../-q.q....D'E.l@.~.....[..Q,m.g........z..R...s.T....(c..k..$p.L.N.E.."...=.5;.S.V2.^.o...1....8....c6X...M....-<ql..x....AaR..o:._.[fm..r..]...........8.....&..J..be.....+(.........E>O_.\...<dmp..;K.E....i...../..B....+8...l.....?..J...YFh+.N2.r.J.ku...lj.+`simO;..c`..JnR.3...=....#...f\K|.2.T...=A.z.A.......{M`.....ao.._KHL..T&..[......%..$.k.. Q..@n.\...#_5mT(5..u=.m.{...B.RC.rQ...D..V9...&{`..t.V-`G.i.Pd.'2...sP.....R~...xK>..........z..)..%T..2.7...^.I$....VbS.UU.,p$.<N.pcNo..*Yi9..%.Q.@U.........Y.n....W..F...J.."@.#?.....A..5.f.F-..;.r..h."*A...`g'.l.aK..j..3.....w..G(.............u.Y.a.;J;O'.!E...x...p<..1b..V...}CrK..b.QZ`..K...R."...Kq....'.{."....G...?.".Bc..i.\h...~.....LV:U ....iL.*W^Mp..~!....D.w.....C&...r..`S..z..}..=zM..%D..B..Cp....U.....+Xb..2[...=..(...8R37.....I.w@...P.).3.g...0..x...5...J..F$..2X...u..1..2..]....

                                                                        C:\Users\user\Pictures\F58q5AtuSb0KXmkDjDm8UY4r.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):7542241
                                                                        Entropy (8bit):7.9998496279545614
                                                                        Encrypted:true
                                                                        SSDEEP:196608:Gs1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyr:G+SDA3JZR9YRyCTJ6iqXr
                                                                        MD5:424B8AF47298CE5AEF4D024365635FF0
                                                                        SHA1:8E6DB834C7BEF5398982EA8398783A966C6A5B9D
                                                                        SHA-256:4EECF0F8D3C3DAB52FA306CAE6BB9F5655EA7C1B47C94FA3059BC9E2EFCF5FFE
                                                                        SHA-512:B67203ADF8EEA89AAE42A340354BE110A46B428B50BCD06565AADCEB444E007A2ECCEDF71D2D883D344D57144B9C02FA95A0740ECE36BED1992C7C53832A9569
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...>.0....A....w....VS..B..k....no~".a3..eu;../..@.Li...u..........u.r....|....}us....X9.-.,..94.cP...=`Y.l..XP..V"-2....."..?.LS..6.Y9H.].b..q..{ &%.Y8(W..D..s..q.n68.!>R.!N..DN^..........*....`.(*"m.B.I.r.P...j.$..3<...;z....~+._.,N............C(.k.s...u..}..Nr*..I..JrS....I,../...........E..Q./..@u..L......(.....#.X#....W.=...m.#....l..k"...:8@=.b.V.....k.&..9.x..........|.A.....d...N.A.k.>;\..n.1..k..B.%M...:....}....S..[e.dE ...=........3[.A.l..Y2.#y.....^..S.'p..."k?0..........x.}...T.#'>..[...q.&a...7/.3Ty.o..".Ji.R.wg..3.......$.m...|.........L..3..O.Q>&E.5.%_...xq...3.CPt.'....^.~..W.....2..4.VN.JKjK.J....e.(......L..<fJg/J...}.go.)..7Z..LM0..1......c{.Vx.T......t._...... O..^..}v....`..._....g..M~-c~..wW.7./Bb...bz...N....b.....2.I.......9......d$}..`..\I...h..f.1..p.k.8..N}*.E..#...W...M...i}.(Z..m.Q...gw.......q....{1.a..G...gq..,.nGI-.......?.5.7.+...}....i.. S<.M.P.,.2.v.^b...DO.1..b...l.T.<....FS.?b...(..Pk..5.$%?8.p

                                                                        C:\Users\user\Pictures\FGncB6Cizu2PKxdPqCgKygMO.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):7542241
                                                                        Entropy (8bit):7.9998496279545614
                                                                        Encrypted:true
                                                                        SSDEEP:196608:Gs1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyr:G+SDA3JZR9YRyCTJ6iqXr
                                                                        MD5:424B8AF47298CE5AEF4D024365635FF0
                                                                        SHA1:8E6DB834C7BEF5398982EA8398783A966C6A5B9D
                                                                        SHA-256:4EECF0F8D3C3DAB52FA306CAE6BB9F5655EA7C1B47C94FA3059BC9E2EFCF5FFE
                                                                        SHA-512:B67203ADF8EEA89AAE42A340354BE110A46B428B50BCD06565AADCEB444E007A2ECCEDF71D2D883D344D57144B9C02FA95A0740ECE36BED1992C7C53832A9569
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...>.0....A....w....VS..B..k....no~".a3..eu;../..@.Li...u..........u.r....|....}us....X9.-.,..94.cP...=`Y.l..XP..V"-2....."..?.LS..6.Y9H.].b..q..{ &%.Y8(W..D..s..q.n68.!>R.!N..DN^..........*....`.(*"m.B.I.r.P...j.$..3<...;z....~+._.,N............C(.k.s...u..}..Nr*..I..JrS....I,../...........E..Q./..@u..L......(.....#.X#....W.=...m.#....l..k"...:8@=.b.V.....k.&..9.x..........|.A.....d...N.A.k.>;\..n.1..k..B.%M...:....}....S..[e.dE ...=........3[.A.l..Y2.#y.....^..S.'p..."k?0..........x.}...T.#'>..[...q.&a...7/.3Ty.o..".Ji.R.wg..3.......$.m...|.........L..3..O.Q>&E.5.%_...xq...3.CPt.'....^.~..W.....2..4.VN.JKjK.J....e.(......L..<fJg/J...}.go.)..7Z..LM0..1......c{.Vx.T......t._...... O..^..}v....`..._....g..M~-c~..wW.7./Bb...bz...N....b.....2.I.......9......d$}..`..\I...h..f.1..p.k.8..N}*.E..#...W...M...i}.(Z..m.Q...gw.......q....{1.a..G...gq..,.nGI-.......?.5.7.+...}....i.. S<.M.P.,.2.v.^b...DO.1..b...l.T.<....FS.?b...(..Pk..5.$%?8.p

                                                                        C:\Users\user\Pictures\FeADCXW0ZcLi7dEJ9fNamelF.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):341
                                                                        Entropy (8bit):7.228277188726768
                                                                        Encrypted:false
                                                                        SSDEEP:6:YmhM5q4NKlNXL0eqJPEOY5CpQoCdWCjUYD9YlgSj63MzqfcfgpfWcii96Z:YK17YPEOY5uQoCsCpaM6qPWcii9a
                                                                        MD5:F02F2E8E6DBFF2F914F9620A070363CF
                                                                        SHA1:1BF04288A71131CDCA4C8A76C7BE3ABEB9576567
                                                                        SHA-256:12FBA084CB716B63C7C04D2E27DFA947FB1AFFD435034302C7DD6988F1BE02EC
                                                                        SHA-512:3BE3B3FB557855E403B8447F17E0808DA913B774662A0DD88AD51033D0023B5DD3853EC08BFAEFB34B205CF7842CB1CCF7B97EB10312002D455D1035A3A96F2A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expir....8Db7..-l.....B....._.9..(....i1v._y$^....I:.....ui.A..s.L.e2P._.~R..}..C.P.'c..Mjf....yg.d.<..6p/....`..s.^..=..Hc0($.VA.uX.-......4...9/qO.Me..8.W.d.`}..8....\.uv.Tk.S.'....W.j...9.:.s....go.'......:Y...`}...T!J.h...S.w.bk..Lv..V.....rw.Nr3.OlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Pictures\FeADCXW0ZcLi7dEJ9fNamelF.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):341
                                                                        Entropy (8bit):7.228277188726768
                                                                        Encrypted:false
                                                                        SSDEEP:6:YmhM5q4NKlNXL0eqJPEOY5CpQoCdWCjUYD9YlgSj63MzqfcfgpfWcii96Z:YK17YPEOY5uQoCsCpaM6qPWcii9a
                                                                        MD5:F02F2E8E6DBFF2F914F9620A070363CF
                                                                        SHA1:1BF04288A71131CDCA4C8A76C7BE3ABEB9576567
                                                                        SHA-256:12FBA084CB716B63C7C04D2E27DFA947FB1AFFD435034302C7DD6988F1BE02EC
                                                                        SHA-512:3BE3B3FB557855E403B8447F17E0808DA913B774662A0DD88AD51033D0023B5DD3853EC08BFAEFB34B205CF7842CB1CCF7B97EB10312002D455D1035A3A96F2A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expir....8Db7..-l.....B....._.9..(....i1v._y$^....I:.....ui.A..s.L.e2P._.~R..}..C.P.'c..Mjf....yg.d.<..6p/....`..s.^..=..Hc0($.VA.uX.-......4...9/qO.Me..8.W.d.`}..8....\.uv.Tk.S.'....W.j...9.:.s....go.'......:Y...`}...T!J.h...S.w.bk..Lv..V.....rw.Nr3.OlfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Pictures\GKjBUOzHFWuZkPSfpmsGrIXJ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\GYngh8EVUEw76N8T1NO6LHCp.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\GlKtZqXQAiyhJM8NCtTVvYcF.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\HtIo7KIXeXJCj2oA9gjrZLg4.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\Pictures\JNxHITgt9Gfgxa9zzN5RQgfc.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768503498951888
                                                                        Encrypted:false
                                                                        SSDEEP:49152:H+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vU:ewrGHip8nfzyeJaipzW88gLvU
                                                                        MD5:F9B6E38B80259C82674A2E043A66507F
                                                                        SHA1:DB2B2057B43D77DC212C20D9DF3A7A3B8BC9655B
                                                                        SHA-256:FE0B9B9A8624551FBEEB578BEBBCD5647CBC5FBF757B463A7A435B9D3BCD300C
                                                                        SHA-512:2B4C4AA4B4BA1C1781DF4D7836A933090397D104E31EDC3A838C0D6FB7BB8EF1F16EEBA09A762631228D9C729BF4B1C440FF1A8832F7EABB868D1FDC8880B4F2
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS.......-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\Pictures\KK8iAf5MAhkTAWCxUa0tQFbr.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\Pictures\KW0cvO7X0axYcWEJHf74m4I5.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\KbXck5SLdtiTd8Kvi7iaPG3v.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\LFQuJgUFeCErm0Je4c8RfLzf.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\LOFVsBSZANM2Xmh0aztGpxRj.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\Minor Policy\5Df8ArC11Wtv2Ms9kUmSHlzE.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):205351
                                                                        Entropy (8bit):7.7192018329312555
                                                                        Encrypted:false
                                                                        SSDEEP:3072:6j1LVE5C/+ipImpy9qC7tOiNHEuCp16ewWUdY7l3HRbOO1CBemcd:Q1ZvydOSqpwevhxbOgd
                                                                        MD5:FEEE5B91EC57B1B55BAC7301B98E5CB4
                                                                        SHA1:7786C00628C8DDA351DCF81C99483D058F3E89B2
                                                                        SHA-256:E64BC0F8CC91E50128B3127893DC9FC26A71A393193726D86260891FB002978F
                                                                        SHA-512:0752668C215D856F8E542FBBD7A210D3CDEC3D3DF7C6F64A59A9C0E2F734A8BC457C81FF5DD90D9C5B465594FD3F687AA5FBF29AE20B629362B58D4D0789211F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<!DOC.......|m.".k.k:`.M,.e.vv.-0..n>QgF......w.PT2rE@..k#..P.&?....g...@..'O..m...T...U...~./.V.zW..[.!.. ]..^0Np..y1*.o|..r..Vs....Q.c|...e.5..@..s.....TZ.H_...:..cw....y?N.!........w....u"5...M...jb.)pR.,.rj.....V.lM~.'.{_.(..<Z.`._....h...#v!.y.....*..O.c.`.F.a..Tc....M.uZ,`....VL;.f...h9.(9.x.jOq.:.0_Qe<.@..S...XA.~U<....^.yE.O.......w.....!./..R..Q..m.......9...TX..d.u.hV..bS_..9...Elh...Oz._f..].^....d1..V>H..)?p......].QJ. .....'.6.m....W....,.s.[P....P_.J..)[..1r.g...@.Z.$....\..M.....%.&..Y..c..+....`&C1J..f...%..E$.T....t.I..J...-p..}...!...o~W......v .w._[...p..-F..y.W2.|....3:.._...t..6.......vX+.,.U.. Dy.?4!..6M.Sm0....m....4U..m:..t.>.]..{V/...@.P)..9....4...9^.?0dG.....x..AOj.=.v.bt...W..kHm~'......q[..4.:..i..kl..S.+J1Dx....3@ME.b...m.z'.i.o....#(...i.......~]..v.Yd%?..P..).%V.....FA.i...S!.N....D...n.-..h.G......cE.......|^6.s.^?]....M.)...6w....y......-0`.2..P...]...7/j..{...R..... .3....b...1.ou...l..:...5c.o

                                                                        C:\Users\user\Pictures\Minor Policy\5Df8ArC11Wtv2Ms9kUmSHlzE.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):205351
                                                                        Entropy (8bit):7.7192018329312555
                                                                        Encrypted:false
                                                                        SSDEEP:3072:6j1LVE5C/+ipImpy9qC7tOiNHEuCp16ewWUdY7l3HRbOO1CBemcd:Q1ZvydOSqpwevhxbOgd
                                                                        MD5:FEEE5B91EC57B1B55BAC7301B98E5CB4
                                                                        SHA1:7786C00628C8DDA351DCF81C99483D058F3E89B2
                                                                        SHA-256:E64BC0F8CC91E50128B3127893DC9FC26A71A393193726D86260891FB002978F
                                                                        SHA-512:0752668C215D856F8E542FBBD7A210D3CDEC3D3DF7C6F64A59A9C0E2F734A8BC457C81FF5DD90D9C5B465594FD3F687AA5FBF29AE20B629362B58D4D0789211F
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<!DOC.......|m.".k.k:`.M,.e.vv.-0..n>QgF......w.PT2rE@..k#..P.&?....g...@..'O..m...T...U...~./.V.zW..[.!.. ]..^0Np..y1*.o|..r..Vs....Q.c|...e.5..@..s.....TZ.H_...:..cw....y?N.!........w....u"5...M...jb.)pR.,.rj.....V.lM~.'.{_.(..<Z.`._....h...#v!.y.....*..O.c.`.F.a..Tc....M.uZ,`....VL;.f...h9.(9.x.jOq.:.0_Qe<.@..S...XA.~U<....^.yE.O.......w.....!./..R..Q..m.......9...TX..d.u.hV..bS_..9...Elh...Oz._f..].^....d1..V>H..)?p......].QJ. .....'.6.m....W....,.s.[P....P_.J..)[..1r.g...@.Z.$....\..M.....%.&..Y..c..+....`&C1J..f...%..E$.T....t.I..J...-p..}...!...o~W......v .w._[...p..-F..y.W2.|....3:.._...t..6.......vX+.,.U.. Dy.?4!..6M.Sm0....m....4U..m:..t.>.]..{V/...@.P)..9....4...9^.?0dG.....x..AOj.=.v.bt...W..kHm~'......q[..4.:..i..kl..S.+J1Dx....3@ME.b...m.z'.i.o....#(...i.......~]..v.Yd%?..P..).%V.....FA.i...S!.N....D...n.-..h.G......cE.......|^6.s.^?]....M.)...6w....y......-0`.2..P...]...7/j..{...R..... .3....b...1.ou...l..:...5c.o

                                                                        C:\Users\user\Pictures\Minor Policy\ErrtrAkcMZ8r6665xKlNCae6.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):205337
                                                                        Entropy (8bit):7.716740515876615
                                                                        Encrypted:false
                                                                        SSDEEP:3072:/UzWOb+WxjipHNeLS1TwBB+0WHAo5FCCWP5qXK+Zi4+6O1CBemcD:/UzKgjiCx8ggFCCIki6gD
                                                                        MD5:F84956CF5FE68930C4EE22BF953E2977
                                                                        SHA1:12976161DEBD211F7A7DB2694963105C1277C97C
                                                                        SHA-256:8DA350605EE9380ECFF8A5FDF909545793B01532116CDE0AFEE43A7B9C3158AA
                                                                        SHA-512:FBB97C349F32D83E49F1B534F87ACEA1262C41379BF98D75A21A95A0F659180C7B6A7526472758F5DBABBA1B042AA54D1C64D1CD560141B3376BA8734F1EB8E8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<!DOC...m....dv...zx......[.|....[N.s..p.m.M.?`H...v.0..$= ...g..F..P|..e*-...W.{....4. .?4.....*[`kql....q.L.i.....).Z..;{.j.......(O.......-/'7..J..nl..Lb..96.+F.. .\....z..I|.c..G.3.6........1/.............S.F..A ..J7...]....2.#.........1.......a.y K....u..)....|"c4..p............F4G....l..n^..:.*.'.X.;.e(rqB.:......m.....Yo.ap.0.g...f/x..AC@..-..s,....0q.V0....<....6.\F....9......c.r.Y.......&;AV.FF.S.[M....$R......6`.0;.,.h..8.....O.R.\y.N8\..2..-...<..n._.M..t.......<6.....v=.*.|Z...[..QjvO.w.q.!...4.~.,.N..h.m..S....`..8.....7....v)..0Z..=../.BH...fko:..V+e-3.uI$..8p.C&.tSbr..'y..w.Lv..X.6 ..x.74...z......K.;........'.rA.0..-....`:mT..a.........Z.0P....J.....o...jj.......~.f0....__.m....C.9=..F.}d........9..;.2..nd...LB(.z..&"&...rw;.....2.S.$....=...R..=..>..L7....#.,..b..1M..1/.. .Y....:-.^... ..R..7D.Y......9O..{c:.&.S.h(...!...,.Z..w.0.-....A...a..........Y.{.`.{.]/.F7.4-.&....%7..>...@KL....|........@j..(YZ..

                                                                        C:\Users\user\Pictures\Minor Policy\ErrtrAkcMZ8r6665xKlNCae6.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):205337
                                                                        Entropy (8bit):7.716740515876615
                                                                        Encrypted:false
                                                                        SSDEEP:3072:/UzWOb+WxjipHNeLS1TwBB+0WHAo5FCCWP5qXK+Zi4+6O1CBemcD:/UzKgjiCx8ggFCCIki6gD
                                                                        MD5:F84956CF5FE68930C4EE22BF953E2977
                                                                        SHA1:12976161DEBD211F7A7DB2694963105C1277C97C
                                                                        SHA-256:8DA350605EE9380ECFF8A5FDF909545793B01532116CDE0AFEE43A7B9C3158AA
                                                                        SHA-512:FBB97C349F32D83E49F1B534F87ACEA1262C41379BF98D75A21A95A0F659180C7B6A7526472758F5DBABBA1B042AA54D1C64D1CD560141B3376BA8734F1EB8E8
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<!DOC...m....dv...zx......[.|....[N.s..p.m.M.?`H...v.0..$= ...g..F..P|..e*-...W.{....4. .?4.....*[`kql....q.L.i.....).Z..;{.j.......(O.......-/'7..J..nl..Lb..96.+F.. .\....z..I|.c..G.3.6........1/.............S.F..A ..J7...]....2.#.........1.......a.y K....u..)....|"c4..p............F4G....l..n^..:.*.'.X.;.e(rqB.:......m.....Yo.ap.0.g...f/x..AC@..-..s,....0q.V0....<....6.\F....9......c.r.Y.......&;AV.FF.S.[M....$R......6`.0;.,.h..8.....O.R.\y.N8\..2..-...<..n._.M..t.......<6.....v=.*.|Z...[..QjvO.w.q.!...4.~.,.N..h.m..S....`..8.....7....v)..0Z..=../.BH...fko:..V+e-3.uI$..8p.C&.tSbr..'y..w.Lv..X.6 ..x.74...z......K.;........'.rA.0..-....`:mT..a.........Z.0P....J.....o...jj.......~.f0....__.m....C.9=..F.}d........9..;.2..nd...LB(.z..&"&...rw;.....2.S.$....=...R..=..>..L7....#.,..b..1M..1/.. .Y....:-.^... ..R..7D.Y......9O..{c:.&.S.h(...!...,.Z..w.0.-....A...a..........Y.{.`.{.]/.F7.4-.&....%7..>...@KL....|........@j..(YZ..

                                                                        C:\Users\user\Pictures\Minor Policy\GXEmL9Hio2yqAqGb8rDpNfoq.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):2115970
                                                                        Entropy (8bit):7.965243763613789
                                                                        Encrypted:false
                                                                        SSDEEP:49152:S2bILVs/Ed4xt+X+1B/aGNpdyP2UOdCNECaDt4C:fwEvB/7Np0+UaCNEsC
                                                                        MD5:7856658CA9F685D7D3270DCBB340C0A0
                                                                        SHA1:D55D4B50CB50B5997E0BBC24E9185C9FBA5294CA
                                                                        SHA-256:FAAB670F07F2AC03187B76085837B6EBB23065BEA063A3AD409AFD511E3181E5
                                                                        SHA-512:11CF66B3FB1123B284605303597F21D64C6F2527BD8CFD6CC48991CD95DF871C3F58D68B367267545E6ECDFD4712C152E179EA63CE7350EEE93230CF16AE39AE
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ.....<I....(=..r.Z.7...._....z$T.G.q......HDWo.(..j.&..G1G.5.6j..r.H..6\(...&[..F...p....P!..L..4P..2^....(...ytEdX.[v~.Us.T..g.......r...,.'/7..U.<..).>.....`j.e(..[.....e....}..!.h....[%..8.+.8f...sG{%-.(.&...5"...x...r...h/..a.?.4.bB..90<O..@%.n....(....8..(R.,.Hv&...75..0MEH..Do....N...E...A...H..'!.5.~./n.s.;~.i....K....fd.c..8...6..pF....[.4..]R.)Y.8..u(.....3tZb..wX...E........O...&.|/g...{h..:..V.JOK?7.........GI.S..Y..p.....J.#z0.6.L.....(.j...).U.r...1.E.{.....F`....R?.i\R.5......XD..pX.........4......}...xt.i.j.9.z......1q..H..W.I.v.p...i.o.4....H....>L..H.?.....Wz....)w<...l.V..k..N.. .}.........4)..VVJg.D.=Y..}.6....4...p3.."..W..'..dv..`.....O..9C.N....i.=M..>./..4...XL`..$..%.'...A.v ..9X(...0.p]..I.B..U.....0CT.t.~q".k.D4N."........q.u.e...Hx.'..}}.#.\J5&q..^.....@.....}.vU.C iM...U..."x.....k~.G...!.RKbFXD..R...5%..=.....<.)P..hey..{........#.F.D.......FC0.mYB....%..j7..M.-..;.j..](..d@..-.V...T..Vc......y@.b..F...F

                                                                        C:\Users\user\Pictures\Minor Policy\GXEmL9Hio2yqAqGb8rDpNfoq.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):2115970
                                                                        Entropy (8bit):7.965243763613789
                                                                        Encrypted:false
                                                                        SSDEEP:49152:S2bILVs/Ed4xt+X+1B/aGNpdyP2UOdCNECaDt4C:fwEvB/7Np0+UaCNEsC
                                                                        MD5:7856658CA9F685D7D3270DCBB340C0A0
                                                                        SHA1:D55D4B50CB50B5997E0BBC24E9185C9FBA5294CA
                                                                        SHA-256:FAAB670F07F2AC03187B76085837B6EBB23065BEA063A3AD409AFD511E3181E5
                                                                        SHA-512:11CF66B3FB1123B284605303597F21D64C6F2527BD8CFD6CC48991CD95DF871C3F58D68B367267545E6ECDFD4712C152E179EA63CE7350EEE93230CF16AE39AE
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ.....<I....(=..r.Z.7...._....z$T.G.q......HDWo.(..j.&..G1G.5.6j..r.H..6\(...&[..F...p....P!..L..4P..2^....(...ytEdX.[v~.Us.T..g.......r...,.'/7..U.<..).>.....`j.e(..[.....e....}..!.h....[%..8.+.8f...sG{%-.(.&...5"...x...r...h/..a.?.4.bB..90<O..@%.n....(....8..(R.,.Hv&...75..0MEH..Do....N...E...A...H..'!.5.~./n.s.;~.i....K....fd.c..8...6..pF....[.4..]R.)Y.8..u(.....3tZb..wX...E........O...&.|/g...{h..:..V.JOK?7.........GI.S..Y..p.....J.#z0.6.L.....(.j...).U.r...1.E.{.....F`....R?.i\R.5......XD..pX.........4......}...xt.i.j.9.z......1q..H..W.I.v.p...i.o.4....H....>L..H.?.....Wz....)w<...l.V..k..N.. .}.........4)..VVJg.D.=Y..}.6....4...p3.."..W..'..dv..`.....O..9C.N....i.=M..>./..4...XL`..$..%.'...A.v ..9X(...0.p]..I.B..U.....0CT.t.~q".k.D4N."........q.u.e...Hx.'..}}.#.\J5&q..^.....@.....}.vU.C iM...U..."x.....k~.G...!.RKbFXD..R...5%..=.....<.)P..hey..{........#.F.D.......FC0.mYB....%..j7..M.-..;.j..](..d@..-.V...T..Vc......y@.b..F...F

                                                                        C:\Users\user\Pictures\Minor Policy\KvSnRxw7nRoWWzdlM6L4ADmH.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):391502
                                                                        Entropy (8bit):7.1573535323796245
                                                                        Encrypted:false
                                                                        SSDEEP:6144:DjZ3qQY5BWx671CC0vf024YFG9aduAOEp9hlh1Jm/dd37BkslF6Lw8y8:vVpY5s45h0vMrYFGou4lh1cFd37BZ2ws
                                                                        MD5:740CB987B4A743A8BD9497438212F46F
                                                                        SHA1:E432ED94E772A01A8E873261FC048E7C213D5DC7
                                                                        SHA-256:50FE86D268C5B10642229F172BCEAA4E9A8FF5FD63F7FFC1472E573F4306F93C
                                                                        SHA-512:1F09B4B5A13122C555864F850259076414CA95A785139294EC352932EDA4A870D814451F3DDA92CED2A4ACB441BB9B647EFC9C8E2345C57034D5D1D513FBF4B7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...A-.....MR.O.aA..eN..<5+...a......$z..c.Mo..y.PD...........cfA.,..G.....<....F.m..z.W.t!.~4.u..A.I^.......o6 y../>j...Ofy.m.ZW.?i.S..X/...B.0S5....j.T\+..y.H.lde....&Z.\i:...c..&7$.:@..'...G.@f GE........I.......4l..@....n`U..Ye.%n..C....6.1.g....J....q...~...c1[.GBn.....C..].,. .X,......._.u.V..,...&....l_.0..J.4.@.BA.Q...g....m..4U.|s....<.s..C?..7a..V...0......p.:....<c_......t.'.5...l...r.9....lHc?B..M....)...kZ.5...\9b.YI2..n..]..n..`..*..].zL..o#.\..l.+.]vM....Q...t.}....sHq....'.P.1... .C.B.!...1.e7."..n^i.=.g...k..:a....{....hs....9... E....,.-A..at @f..{...D....t.^z..2\Z>1..N.FT...k<. l.....G.?....t..L........-YJ..T......G...`V../.}.x9...........J..T/s........'h.i..&o....nvI.6.'..C..Yd...>.e-..t|...@.....l..<.|....}....8\\..._..v..Q\.+.x-5...x..(Y..Y..\XH..2.2...0...\K..5...o%...y7.4.F.......g.5.W.._..G.*..m.^x.(...D*..........j....{.....h....*..k....y;..."/.y.....+..3.}(.9...o...U....V7..^G..!....B.O...t.E6<k...u..A

                                                                        C:\Users\user\Pictures\Minor Policy\KvSnRxw7nRoWWzdlM6L4ADmH.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):391502
                                                                        Entropy (8bit):7.1573535323796245
                                                                        Encrypted:false
                                                                        SSDEEP:6144:DjZ3qQY5BWx671CC0vf024YFG9aduAOEp9hlh1Jm/dd37BkslF6Lw8y8:vVpY5s45h0vMrYFGou4lh1cFd37BZ2ws
                                                                        MD5:740CB987B4A743A8BD9497438212F46F
                                                                        SHA1:E432ED94E772A01A8E873261FC048E7C213D5DC7
                                                                        SHA-256:50FE86D268C5B10642229F172BCEAA4E9A8FF5FD63F7FFC1472E573F4306F93C
                                                                        SHA-512:1F09B4B5A13122C555864F850259076414CA95A785139294EC352932EDA4A870D814451F3DDA92CED2A4ACB441BB9B647EFC9C8E2345C57034D5D1D513FBF4B7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...A-.....MR.O.aA..eN..<5+...a......$z..c.Mo..y.PD...........cfA.,..G.....<....F.m..z.W.t!.~4.u..A.I^.......o6 y../>j...Ofy.m.ZW.?i.S..X/...B.0S5....j.T\+..y.H.lde....&Z.\i:...c..&7$.:@..'...G.@f GE........I.......4l..@....n`U..Ye.%n..C....6.1.g....J....q...~...c1[.GBn.....C..].,. .X,......._.u.V..,...&....l_.0..J.4.@.BA.Q...g....m..4U.|s....<.s..C?..7a..V...0......p.:....<c_......t.'.5...l...r.9....lHc?B..M....)...kZ.5...\9b.YI2..n..]..n..`..*..].zL..o#.\..l.+.]vM....Q...t.}....sHq....'.P.1... .C.B.!...1.e7."..n^i.=.g...k..:a....{....hs....9... E....,.-A..at @f..{...D....t.^z..2\Z>1..N.FT...k<. l.....G.?....t..L........-YJ..T......G...`V../.}.x9...........J..T/s........'h.i..&o....nvI.6.'..C..Yd...>.e-..t|...@.....l..<.|....}....8\\..._..v..Q\.+.x-5...x..(Y..Y..\XH..2.2...0...\K..5...o%...y7.4.F.......g.5.W.._..G.*..m.^x.(...D*..........j....{.....h....*..k....y;..."/.y.....+..3.}(.9...o...U....V7..^G..!....B.O...t.E6<k...u..A

                                                                        C:\Users\user\Pictures\Minor Policy\MAq6dYMqMOp7jsSy8ZTXM3iM.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):7539174
                                                                        Entropy (8bit):7.96205328933494
                                                                        Encrypted:false
                                                                        SSDEEP:196608:qZ7XnEuPGzEZHYiD5Nh4/rPiPlN23i1b7rkVfH3:qhBIe3D5NiSdXkhX
                                                                        MD5:6012B3E4C8FBC8CA9797919A80A315B5
                                                                        SHA1:771DA958BE2F863744C68B270182693E7306F8BC
                                                                        SHA-256:1A2E78FEE83BD10BD870AC480B4D85D075C70FAC01B37C39D682B2E6BF0EA5ED
                                                                        SHA-512:C2846C4A1B8F10EBB369A599940AE1471B2E647E586F0F5FF7C601B68123CE620D0BD94AF21D8838F621603C3DAF89E283256E091F7C94250D212F0E8FD5B126
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...C7P.wv*P...(..m.c.g.v..........a...x.>......SHmq.{G7.^T...q#.RUFx8lV.S..>.l.;..Z..J..D.....v..]T......ex.cs_.Z.X%M..%........E$. )...5~...>..T......FXT.o.]X.?.Y|S..p..S....^..........<..}r}'.%.T +K..[..gR:b.g*...RXRd...KD#R.`v...#O..p.:.LI..-.....y...=.Er...v.8.\.W...._0.iM..tnL[.-.B.%.%..........qA.^....&..X.C#.4S..,.M.'.%.n..."..N...U..qD.5.'.\....>.2.K..n;....8E..0<..@......._.&.|oK.AT....F6>.p.........I....G....'2....:.G..R..=Z.H...:k]}.....3.xBd..s..j......X$./m...m....M=3.......|.k.i..:V,~.o.4..=..MQjPG$.+(.......".I+.._.....I.d1..hV.G....t.2..4.[T7.9....Qk....W......!.P{..bo.G@qF......<...D8...TX..?......o.^...'./w..7g..n./.@-e..D....^Z%.K..I...`M..}..cn4.$...z../g>[.zS..Y8...y.M$?......0....6.......%.h!3..<....e].CK-..h...$.GQ.....{.CN#..-..e.z1jd..I...uV%k..i.M.!.Hv[.$}....R..u".....Y..O.t...s.\.=...._.^y_.....Y.kI...$.s-.7.C...)_.e.....(.ky=..nU..;...h.....D.r?o....M.%.l.L5.b. tP.$.|..7..7..]Q.....K~].w...<.o......1Zm....oZ

                                                                        C:\Users\user\Pictures\Minor Policy\MAq6dYMqMOp7jsSy8ZTXM3iM.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):7539174
                                                                        Entropy (8bit):7.96205328933494
                                                                        Encrypted:false
                                                                        SSDEEP:196608:qZ7XnEuPGzEZHYiD5Nh4/rPiPlN23i1b7rkVfH3:qhBIe3D5NiSdXkhX
                                                                        MD5:6012B3E4C8FBC8CA9797919A80A315B5
                                                                        SHA1:771DA958BE2F863744C68B270182693E7306F8BC
                                                                        SHA-256:1A2E78FEE83BD10BD870AC480B4D85D075C70FAC01B37C39D682B2E6BF0EA5ED
                                                                        SHA-512:C2846C4A1B8F10EBB369A599940AE1471B2E647E586F0F5FF7C601B68123CE620D0BD94AF21D8838F621603C3DAF89E283256E091F7C94250D212F0E8FD5B126
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...C7P.wv*P...(..m.c.g.v..........a...x.>......SHmq.{G7.^T...q#.RUFx8lV.S..>.l.;..Z..J..D.....v..]T......ex.cs_.Z.X%M..%........E$. )...5~...>..T......FXT.o.]X.?.Y|S..p..S....^..........<..}r}'.%.T +K..[..gR:b.g*...RXRd...KD#R.`v...#O..p.:.LI..-.....y...=.Er...v.8.\.W...._0.iM..tnL[.-.B.%.%..........qA.^....&..X.C#.4S..,.M.'.%.n..."..N...U..qD.5.'.\....>.2.K..n;....8E..0<..@......._.&.|oK.AT....F6>.p.........I....G....'2....:.G..R..=Z.H...:k]}.....3.xBd..s..j......X$./m...m....M=3.......|.k.i..:V,~.o.4..=..MQjPG$.+(.......".I+.._.....I.d1..hV.G....t.2..4.[T7.9....Qk....W......!.P{..bo.G@qF......<...D8...TX..?......o.^...'./w..7g..n./.@-e..D....^Z%.K..I...`M..}..cn4.$...z../g>[.zS..Y8...y.M$?......0....6.......%.h!3..<....e].CK-..h...$.GQ.....{.CN#..-..e.z1jd..I...uV%k..i.M.!.Hv[.$}....R..u".....Y..O.t...s.\.=...._.^y_.....Y.kI...$.s-.7.C...)_.e.....(.ky=..nU..;...h.....D.r?o....M.%.l.L5.b. tP.$.|..7..7..]Q.....K~].w...<.o......1Zm....oZ

                                                                        C:\Users\user\Pictures\Minor Policy\UZMd9akv_Vfb8MG5RwDjTpGs.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):652110
                                                                        Entropy (8bit):7.426085638702326
                                                                        Encrypted:false
                                                                        SSDEEP:6144:LDp899z+e1GXwmbGaPsUOwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP13:fq95UXw1U0cH5049Duca049Duc1y6D
                                                                        MD5:207E97B7E1E23982DC87ADECBB837402
                                                                        SHA1:45B95E0F64FD2A60B7EB47AF3E1102DDD280A7B7
                                                                        SHA-256:B0E0313914126DE5A854FFD7C077A8D4066FF523D2439A9B5ED0F587B3B891C9
                                                                        SHA-512:D04E2520DE16BF1ED0DA8AD403CA20D4AE52EFBB67B7E21EB7693497314ECC3F36D6D128124AA8521A737DB9849CAE3D78830ED00BF6AE4C56FF756C1F93E165
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...}.....V.I__%.....*%.X.....v...s<...B..F..5..q.a...L,..`...\.Y<..U{{'..{L.c..,sY...S.=}....#,..U...hS.AU....#]..IaK.N8..).........gwA1...V..]z.&4.F....>]...7+...#...\.07M.X. cg..u/H)..?.Z...W..*...k;.\......:..}......q.daF>.g..T...p.. .....zn.F'A....Y/#g.6A..P..W|....v....b\.?.b..t|L.......Km[Jr.rN..=9....Z9.Wg..1.......V..._S..Z....?.......F....&...../.....-...hqb.[.......Mt$.Ud...p..+.7..r..G.e.."xOt}NftD..7.:L/}4..e-.;.......8?...uMr..."..T.<\.....}."f+...B.om..+.. .k5.,...V....}s....+..6........@.......(......{...,...N..]..u....f...-.......*O.S.q..dEW$cs...T....d..Gu.I2..,..p?..A...C.X...`<..w.N.r4.&.X9c.<.......c..p.iJz.e[.!...=...TF.L..].bY....{.RNS2..|.4..DC..S:$..f.G>=......(;j.....5.uL.6.,}~baO0..M....j...W.T.k...%.Fo.HJ..0.\[...g....4Q...X>).^&.U..07.V..t........I...g.J...P.n..%.......<k......;N.....p..I8.)....6.<...:.`.r)...C.F.}.a..?D\..6.>.......jz..,..|..8...e.T....N.,'..Y....b...........d...4.....%f....X.q..!...c7R

                                                                        C:\Users\user\Pictures\Minor Policy\UZMd9akv_Vfb8MG5RwDjTpGs.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):652110
                                                                        Entropy (8bit):7.426085638702326
                                                                        Encrypted:false
                                                                        SSDEEP:6144:LDp899z+e1GXwmbGaPsUOwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP13:fq95UXw1U0cH5049Duca049Duc1y6D
                                                                        MD5:207E97B7E1E23982DC87ADECBB837402
                                                                        SHA1:45B95E0F64FD2A60B7EB47AF3E1102DDD280A7B7
                                                                        SHA-256:B0E0313914126DE5A854FFD7C077A8D4066FF523D2439A9B5ED0F587B3B891C9
                                                                        SHA-512:D04E2520DE16BF1ED0DA8AD403CA20D4AE52EFBB67B7E21EB7693497314ECC3F36D6D128124AA8521A737DB9849CAE3D78830ED00BF6AE4C56FF756C1F93E165
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...}.....V.I__%.....*%.X.....v...s<...B..F..5..q.a...L,..`...\.Y<..U{{'..{L.c..,sY...S.=}....#,..U...hS.AU....#]..IaK.N8..).........gwA1...V..]z.&4.F....>]...7+...#...\.07M.X. cg..u/H)..?.Z...W..*...k;.\......:..}......q.daF>.g..T...p.. .....zn.F'A....Y/#g.6A..P..W|....v....b\.?.b..t|L.......Km[Jr.rN..=9....Z9.Wg..1.......V..._S..Z....?.......F....&...../.....-...hqb.[.......Mt$.Ud...p..+.7..r..G.e.."xOt}NftD..7.:L/}4..e-.;.......8?...uMr..."..T.<\.....}."f+...B.om..+.. .k5.,...V....}s....+..6........@.......(......{...,...N..]..u....f...-.......*O.S.q..dEW$cs...T....d..Gu.I2..,..p?..A...C.X...`<..w.N.r4.&.X9c.<.......c..p.iJz.e[.!...=...TF.L..].bY....{.RNS2..|.4..DC..S:$..f.G>=......(;j.....5.uL.6.,}~baO0..M....j...W.T.k...%.Fo.HJ..0.\[...g....4Q...X>).^&.U..07.V..t........I...g.J...P.n..%.......<k......;N.....p..I8.)....6.<...:.`.r)...C.F.}.a..?D\..6.>.......jz..,..|..8...e.T....N.,'..Y....b...........d...4.....%f....X.q..!...c7R

                                                                        C:\Users\user\Pictures\Minor Policy\XxaWUuSPH3Fo3U3cdFyCwDfN.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):313678
                                                                        Entropy (8bit):5.845737897807397
                                                                        Encrypted:false
                                                                        SSDEEP:3072:k2L/TpFOhaUUCoCbIMRxetMwxcFYryTc2xyfGzYMqpnPc2JecbkTaMG0aY/Ua/sU:ZLp7C8cx2MCcFHMhdPcElg+XtYMMWK
                                                                        MD5:E1B2577EDF39201FB4286F67A6F3A3A5
                                                                        SHA1:C1245871D75675FDCE0B1319CF00C8C900AB514B
                                                                        SHA-256:6D1A2C1F833636F7B31941E198DEF3C07546D602D514BD12A5AA6D664F2C2BC1
                                                                        SHA-512:A2587C932BF983B5806FFF32BF9589D2D5F8ED5386B9F0FCFFE21400EB12E08DEF5FEFC73F34369F811A3482ABF1B4BAB652AFC12CA4EC4F176CA54840450BA3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...a...Zvb|$z4+....Y...h@.l._u..8;.Y......o.89..........\..G9.v}....J.......F.A...p...e..Eu.}..3.z>..U.j.Y..sR...k..u.n. ....~[.&CM..(..p..j..q...U4xdN..'."<..._.hK.c..5.}x..|.%..w.k...T..h`.8i/V.Y...X..0uY.I....q+.6iz.....(.rr.S.G....os..T.n@)..#.D..,........"UdzFy..x..d........*......!. w..Q..x.t..Ss.y.!...X.,6.....rP.,....I..J..N=kMO.bJ........*L.C.k..?. .1.D.[..'(Cg...>...9..."..../.TI....9.j.)... .x3M...+..&O...DR.$....i.Zsf..W.J=..lJp#.4D7....,..qb.....]....%.%.;&.}....]d.../.'$s.'d..'-o}..}......9^QR.i..8 .s;]c..x..~..==.b.8..SJ.7x.D.M@...e="u.z.........xq@...e_... 2.YZ:.K..Y..j..E..y.z..D.K..N.~.B..q_g.E.s{M.-......CM..i.F......j......|.A...Rh.{.J.fwP..X.?V.%...7....CA..J0.......H....\K.-z..M.Xl.J....u1....<...t...97..mnx..D........#.gM.9..MR..~..q_I..:j.........\..e..<.0...\*..n1>v..e^.4.xT.n......Z@L...2O..oE...H.(.XC.....u.q.....O*w......?..).a.'.&...;b....N......'..!=`[..1..y..m..Z.4;.S*......9.....Cq....t...d.

                                                                        C:\Users\user\Pictures\Minor Policy\XxaWUuSPH3Fo3U3cdFyCwDfN.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):313678
                                                                        Entropy (8bit):5.845737897807397
                                                                        Encrypted:false
                                                                        SSDEEP:3072:k2L/TpFOhaUUCoCbIMRxetMwxcFYryTc2xyfGzYMqpnPc2JecbkTaMG0aY/Ua/sU:ZLp7C8cx2MCcFHMhdPcElg+XtYMMWK
                                                                        MD5:E1B2577EDF39201FB4286F67A6F3A3A5
                                                                        SHA1:C1245871D75675FDCE0B1319CF00C8C900AB514B
                                                                        SHA-256:6D1A2C1F833636F7B31941E198DEF3C07546D602D514BD12A5AA6D664F2C2BC1
                                                                        SHA-512:A2587C932BF983B5806FFF32BF9589D2D5F8ED5386B9F0FCFFE21400EB12E08DEF5FEFC73F34369F811A3482ABF1B4BAB652AFC12CA4EC4F176CA54840450BA3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...a...Zvb|$z4+....Y...h@.l._u..8;.Y......o.89..........\..G9.v}....J.......F.A...p...e..Eu.}..3.z>..U.j.Y..sR...k..u.n. ....~[.&CM..(..p..j..q...U4xdN..'."<..._.hK.c..5.}x..|.%..w.k...T..h`.8i/V.Y...X..0uY.I....q+.6iz.....(.rr.S.G....os..T.n@)..#.D..,........"UdzFy..x..d........*......!. w..Q..x.t..Ss.y.!...X.,6.....rP.,....I..J..N=kMO.bJ........*L.C.k..?. .1.D.[..'(Cg...>...9..."..../.TI....9.j.)... .x3M...+..&O...DR.$....i.Zsf..W.J=..lJp#.4D7....,..qb.....]....%.%.;&.}....]d.../.'$s.'d..'-o}..}......9^QR.i..8 .s;]c..x..~..==.b.8..SJ.7x.D.M@...e="u.z.........xq@...e_... 2.YZ:.K..Y..j..E..y.z..D.K..N.~.B..q_g.E.s{M.-......CM..i.F......j......|.A...Rh.{.J.fwP..X.?V.%...7....CA..J0.......H....\K.-z..M.Xl.J....u1....<...t...97..mnx..D........#.gM.9..MR..~..q_I..:j.........\..e..<.0...\*..n1>v..e^.4.xT.n......Z@L...2O..oE...H.(.XC.....u.q.....O*w......?..).a.'.&...;b....N......'..!=`[..1..y..m..Z.4;.S*......9.....Cq....t...d.

                                                                        C:\Users\user\Pictures\Minor Policy\dHxqqbbMHpGRP1KlVseWr6lF.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):1294158
                                                                        Entropy (8bit):6.6608894191907355
                                                                        Encrypted:false
                                                                        SSDEEP:24576:CC289c+gpDDk1mPxLfYwV2Wcl4x+SxnFwjj4mDXrE:F1mPxLMRCznFwjj4mrrE
                                                                        MD5:DC079916C5D786C4A504F0C932D085A5
                                                                        SHA1:166726C3A6A470833F5FEBB974580A76BD9699AB
                                                                        SHA-256:7D561192F3A92309689EEA6A7FFE3E8AAC0F57D9C92422C784D54C5EAE0A524C
                                                                        SHA-512:6A1B4B44E995E25A5C002D833B81EE48578E5A726F1777EF881CC31EC475085BFA2CA9C04CA4F6F2084007EA1394FC61544C45E273B04F8374C95A1AE8E34D3B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ.....o..d...H.r.J .}...aq=.N.L..Du.]...=.bb.,WM}BK..d.\.WHl~...j.Q=bO.._z'D+.r...A...M..`.g.Q.{*..]....qj.t.....B..?l.<.a....}.^....~....?a..3.2.3.O.F...:...=.'j.S|.~..:..=w..wp.....t.i...G].o.W.p.a.:.,.:...n.{.Xq..x.,........;".Q}.S&.{0...\lsY..'}.g..`.T..0 .9....D.O.d...J........2&....mB9ppU.^zN.}O.E....\..@4..KF..p....c.J...r.PI...I...X6.0;...pt....25.JN.....D6.Rc...sK.mL......a.$r."..X..E..T.....4.8...^E............8T..1.1e.....L..".N..{|.`....I.H....7qk.&#.......!T..!.N..J..LvJ....EP....6E..J.a..d.@.<..rx.....R.&....V.D.P..`.n.|....4;.w..........b.E.I.]#D.....1..Q..j.=..3l..;I....*_v.g..TO....k^....y...\.k.Q...=r.t...O>....126q..l...K..a......x...wl{y<'j.@zk............4.....b...G.][.vT.A).<.......g+.I?$...........#."3.......V.0.3.&D....KM.1m....;.D6...@.P.......c....:@.h......wf.t.6.A..wY..........8..I.4WA.j.F...&5:m...U......_.^.p..,.[..:...@....H.$@...m..R._.=.RF...._....Z.<.'.0..NN.+.ng'...V..uDc$S.I.4>.X.w.....hlM.~.

                                                                        C:\Users\user\Pictures\Minor Policy\dHxqqbbMHpGRP1KlVseWr6lF.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):1294158
                                                                        Entropy (8bit):6.6608894191907355
                                                                        Encrypted:false
                                                                        SSDEEP:24576:CC289c+gpDDk1mPxLfYwV2Wcl4x+SxnFwjj4mDXrE:F1mPxLMRCznFwjj4mrrE
                                                                        MD5:DC079916C5D786C4A504F0C932D085A5
                                                                        SHA1:166726C3A6A470833F5FEBB974580A76BD9699AB
                                                                        SHA-256:7D561192F3A92309689EEA6A7FFE3E8AAC0F57D9C92422C784D54C5EAE0A524C
                                                                        SHA-512:6A1B4B44E995E25A5C002D833B81EE48578E5A726F1777EF881CC31EC475085BFA2CA9C04CA4F6F2084007EA1394FC61544C45E273B04F8374C95A1AE8E34D3B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ.....o..d...H.r.J .}...aq=.N.L..Du.]...=.bb.,WM}BK..d.\.WHl~...j.Q=bO.._z'D+.r...A...M..`.g.Q.{*..]....qj.t.....B..?l.<.a....}.^....~....?a..3.2.3.O.F...:...=.'j.S|.~..:..=w..wp.....t.i...G].o.W.p.a.:.,.:...n.{.Xq..x.,........;".Q}.S&.{0...\lsY..'}.g..`.T..0 .9....D.O.d...J........2&....mB9ppU.^zN.}O.E....\..@4..KF..p....c.J...r.PI...I...X6.0;...pt....25.JN.....D6.Rc...sK.mL......a.$r."..X..E..T.....4.8...^E............8T..1.1e.....L..".N..{|.`....I.H....7qk.&#.......!T..!.N..J..LvJ....EP....6E..J.a..d.@.<..rx.....R.&....V.D.P..`.n.|....4;.w..........b.E.I.]#D.....1..Q..j.=..3l..;I....*_v.g..TO....k^....y...\.k.Q...=r.t...O>....126q..l...K..a......x...wl{y<'j.@zk............4.....b...G.][.vT.A).<.......g+.I?$...........#."3.......V.0.3.&D....KM.1m....;.D6...@.P.......c....:@.h......wf.t.6.A..wY..........8..I.4WA.j.F...&5:m...U......_.^.p..,.[..:...@....H.$@...m..R._.=.RF...._....Z.<.'.0..NN.+.ng'...V..uDc$S.I.4>.X.w.....hlM.~.

                                                                        C:\Users\user\Pictures\Minor Policy\dl0eBw1a4nselM03kEjNFUeZ.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):313678
                                                                        Entropy (8bit):5.8437005947083644
                                                                        Encrypted:false
                                                                        SSDEEP:3072:snKGUund1zDjI815DI5h6R777jxeeP14fkzJWps9uaQhdb6JVgsMet0lvSf:KKg1zDjV15D+KXYeP2f82qsdWJV0xO
                                                                        MD5:D412B89A15EBA21A4B4BCE404FFF1FD7
                                                                        SHA1:DA1B7D20652A3F7FC87931ACC4813EDDA68411D8
                                                                        SHA-256:7AFDF290440B62A5C83803D75FFFCEE3819493097BA2F243EFBC34471586F38F
                                                                        SHA-512:993D5CEFA5389D8B0F2E69FCDD97CE47366EB0F05815F91D9F3A78B8184C0FC0283A21D04ECCA27C6212DE484A79CFB56D0356D431559917A6B79BC19078639D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...~...V<O.?...>2...Y.....fl.`C..q.Oy3a.A.!p.^pv.k*...6...g...........u.......?.[.s..snf...2...NY8H....J."m.."a..h.........y$%..!..>....R..+......_.M.....c.ii.5s..|.....s.I.3v...r.7/q.;s.%Yk[.h-.[?2G.J.9\...}...w..,.....A8.g.d..0yv.....<.-.0....F..6!./.....r".P..E...^X.a..Z)|1.....j...X..E.....#Q.+....\......\....y.....K.._ZU.j.(........Q..Q..L).G....Ej..u..|.....R.u...;.J.,.@G.9YzB..@..DV..&....w..T'|.U..t..........P..^.!Fj..?Tz.>......Q.#=...-......x.....w...k&@..i..fO5v.....I...(.%.;H..l..4..^.....yH.w...M.Z...R<.Y..I.i.*...n]z.B...9..5...z.....:c.9&..}A.).I..T=./.@u.tf...H...$*-f.1.P/+...G....S.f.$...,........*}v.-m..Xi.5.!.\.a...{Y.Y.....L..|8.6...5....T....v..Q2..x.n..F.V.;..[>.]..}..g..6^.....%....`<....s.....4i.]../{5.....TAZK....Hr...*.y...76.v.qdl.y.7lZ.RF_...d..$....#8..c...CP"&..b.^T+...o...%.~...-..I Q.w..~E..=........L|Y..O=>..5.V....b.=.......R.Hf.jhM./6.:j.e......9.E....H.rT..:Yw...i.-=.-E..#..W...........-....K..

                                                                        C:\Users\user\Pictures\Minor Policy\dl0eBw1a4nselM03kEjNFUeZ.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):313678
                                                                        Entropy (8bit):5.8437005947083644
                                                                        Encrypted:false
                                                                        SSDEEP:3072:snKGUund1zDjI815DI5h6R777jxeeP14fkzJWps9uaQhdb6JVgsMet0lvSf:KKg1zDjV15D+KXYeP2f82qsdWJV0xO
                                                                        MD5:D412B89A15EBA21A4B4BCE404FFF1FD7
                                                                        SHA1:DA1B7D20652A3F7FC87931ACC4813EDDA68411D8
                                                                        SHA-256:7AFDF290440B62A5C83803D75FFFCEE3819493097BA2F243EFBC34471586F38F
                                                                        SHA-512:993D5CEFA5389D8B0F2E69FCDD97CE47366EB0F05815F91D9F3A78B8184C0FC0283A21D04ECCA27C6212DE484A79CFB56D0356D431559917A6B79BC19078639D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...~...V<O.?...>2...Y.....fl.`C..q.Oy3a.A.!p.^pv.k*...6...g...........u.......?.[.s..snf...2...NY8H....J."m.."a..h.........y$%..!..>....R..+......_.M.....c.ii.5s..|.....s.I.3v...r.7/q.;s.%Yk[.h-.[?2G.J.9\...}...w..,.....A8.g.d..0yv.....<.-.0....F..6!./.....r".P..E...^X.a..Z)|1.....j...X..E.....#Q.+....\......\....y.....K.._ZU.j.(........Q..Q..L).G....Ej..u..|.....R.u...;.J.,.@G.9YzB..@..DV..&....w..T'|.U..t..........P..^.!Fj..?Tz.>......Q.#=...-......x.....w...k&@..i..fO5v.....I...(.%.;H..l..4..^.....yH.w...M.Z...R<.Y..I.i.*...n]z.B...9..5...z.....:c.9&..}A.).I..T=./.@u.tf...H...$*-f.1.P/+...G....S.f.$...,........*}v.-m..Xi.5.!.\.a...{Y.Y.....L..|8.6...5....T....v..Q2..x.n..F.V.;..[>.]..}..g..6^.....%....`<....s.....4i.]../{5.....TAZK....Hr...*.y...76.v.qdl.y.7lZ.RF_...d..$....#8..c...CP"&..b.^T+...o...%.~...-..I Q.w..~E..=........L|Y..O=>..5.V....b.=.......R.Hf.jhM./6.:j.e......9.E....H.rT..:Yw...i.-=.-E..#..W...........-....K..

                                                                        C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):349518
                                                                        Entropy (8bit):7.091205563229998
                                                                        Encrypted:false
                                                                        SSDEEP:6144:2K2vDGCLM9rjN7AwkAW+8BFtdOYAADE3J4uSbJN3lEN1aPTiS:2K2vaCwNj9AwkBB/dOYACuSbJN3lWS
                                                                        MD5:F47D60F85CCA54483262A61CFE38F08C
                                                                        SHA1:D285CB2374D877C3778948EE1EC018FA7EFC9551
                                                                        SHA-256:B50E3EA55C0573EC26E29D1DF24F21AA2A41E160956DCB413D0A4BFDE8E0D0AA
                                                                        SHA-512:2DC36BFFA21272912D78C4CAC05561AD97D1AE61A942428E10B1213D3303ADA9C5D44011847D67FEC55CE24A4D2371C5B7C50404FF5E64FF903961AFA9D886CF
                                                                        Malicious:true
                                                                        Yara Hits:
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe, Author: Joe Security
                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe, Author: ditekSHen
                                                                        Reputation:low
                                                                        Preview:MZ............O9.\...l.%(g.Z.D..W&k.........M...>.e.4.P_..J.......}..!..Z...D..Z....[..aQ.....w+.^.jDE...}P%z.>;...E..EZj....w..9...R.)'Y.z.T>.t/.5.v.2.S\d2K:..LC..Er..jC...B....*.B.J....>.[.....B?.y.AP..=t.R.h.-..+Wa...k.6Nh...f.rL...qBp.h...|b0.......M.O.S"Z....Q.P...xX...RG8.........*f..j..f8.P..k..T.0y.Q..{..."r.;..4..T..3>....3.~.0.....M..u...n..~..33.?.V.I&.j..tG'..#.H.0.t...IA......j...'t.T.q..;.+7..L.:........*.`....l......'H,.....$........w.....'..Q .2k.d@!Y.H..'>.O.:..-...U...../.T..n8z...{..0.#$....f.6..7.D\U..Dq.q.^.pv........j.s.n....[.(..b;#....(.....D...y...o.<......I|.i#.(...G..=s.G.Q.....u'.t2.(....c..\.;.t.G.{.j..w..CH...0.....dC...|.^..P....P..6..?]....E..o..F..4"i..K+.5......:...q.5.A.7.......V8-y..|5.M....l.?<..J......+..:Z.f.k*.....e....VM..-#...\.U....<.G...n..z*h=|?.z..'\#p....7.....V.A6.........|....\en...n...c..".I...l...A...i.s]g.."q.ff.s..V......UH....-$...B.C..b...U..G...F.>..B?.F..zf....Ol4.k.E..F.s"

                                                                        C:\Users\user\Pictures\Minor Policy\oM7t40xLe0OgCrSQGKhQ7p6Z.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):349518
                                                                        Entropy (8bit):7.091205563229998
                                                                        Encrypted:false
                                                                        SSDEEP:6144:2K2vDGCLM9rjN7AwkAW+8BFtdOYAADE3J4uSbJN3lEN1aPTiS:2K2vaCwNj9AwkBB/dOYACuSbJN3lWS
                                                                        MD5:F47D60F85CCA54483262A61CFE38F08C
                                                                        SHA1:D285CB2374D877C3778948EE1EC018FA7EFC9551
                                                                        SHA-256:B50E3EA55C0573EC26E29D1DF24F21AA2A41E160956DCB413D0A4BFDE8E0D0AA
                                                                        SHA-512:2DC36BFFA21272912D78C4CAC05561AD97D1AE61A942428E10B1213D3303ADA9C5D44011847D67FEC55CE24A4D2371C5B7C50404FF5E64FF903961AFA9D886CF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ............O9.\...l.%(g.Z.D..W&k.........M...>.e.4.P_..J.......}..!..Z...D..Z....[..aQ.....w+.^.jDE...}P%z.>;...E..EZj....w..9...R.)'Y.z.T>.t/.5.v.2.S\d2K:..LC..Er..jC...B....*.B.J....>.[.....B?.y.AP..=t.R.h.-..+Wa...k.6Nh...f.rL...qBp.h...|b0.......M.O.S"Z....Q.P...xX...RG8.........*f..j..f8.P..k..T.0y.Q..{..."r.;..4..T..3>....3.~.0.....M..u...n..~..33.?.V.I&.j..tG'..#.H.0.t...IA......j...'t.T.q..;.+7..L.:........*.`....l......'H,.....$........w.....'..Q .2k.d@!Y.H..'>.O.:..-...U...../.T..n8z...{..0.#$....f.6..7.D\U..Dq.q.^.pv........j.s.n....[.(..b;#....(.....D...y...o.<......I|.i#.(...G..=s.G.Q.....u'.t2.(....c..\.;.t.G.{.j..w..CH...0.....dC...|.^..P....P..6..?]....E..o..F..4"i..K+.5......:...q.5.A.7.......V8-y..|5.M....l.?<..J......+..:Z.f.k*.....e....VM..-#...\.U....<.G...n..z*h=|?.z..'\#p....7.....V.A6.........|....\en...n...c..".I...l...A...i.s]g.."q.ff.s..V......UH....-$...B.C..b...U..G...F.>..B?.F..zf....Ol4.k.E..F.s"

                                                                        C:\Users\user\Pictures\Minor Policy\uusesdQ3Edo2k5kNA0mkf5gw.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):391502
                                                                        Entropy (8bit):7.166970852018235
                                                                        Encrypted:false
                                                                        SSDEEP:6144:DMscnF9k6mcRoe81qF3bbuAO20vCHI112hYo0KTw8yf:DcnFC0Rl81SfuvvCHI1mw8yf
                                                                        MD5:CEB2459748788BB810308BF0E0F4C4C5
                                                                        SHA1:7F7B241D108DF1E5C31EEDD07C52E780E07EAD1F
                                                                        SHA-256:F069656A5159C2BB61DFC6DD12E7C0526A71A5173ACA223EFD731047B06A08AC
                                                                        SHA-512:8208309C14120AD157C3200055B188D54AB7033B8B18B52F4A0510FDC47C4BD49C67F563A1C40B1FE07E17469AFD592E4AE1CBCA153CA630D9144691A28EF3E5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ....Z.(.q..rp.....Ws&.....}....yL..m..L.*$3Y.....m.@N......s\N. ....C..KN.Q....rf[....r..%.NP..)./..L.....*.>.#.........sg.^.J......zl>|F..,..7.....tI.j.c..0.[.$.Q.].s@.vD.-A.R......P._....@.-.p.....9.,6......}.$h....."..:z....w,....}oP.. .`..p`.S4 oe.y...r..!b.X....i%.=P3.9|.I.|"..O;/.;..'&.&....L....7K.&.9h....%"v.-i..qW....".U.&+,0!$..Y....j....g.{h.F..\.%H.jQ!.....R9H....(6..@.....)!.XC........'b..N..... ?....^..k.yy.,.A.Q,M!..h..C.W.).8.ZUX..}qoJ.='.*...uv...+FP...c.x2...n........&.C3-.N..K.!.x3....xr'.j..M.\.h4..cE.i.xJ...#.[N.mcG.. ..H..W_S.3.,*i.....O....V.qd&9*.7...........f{..W.+>.1.|.......'vL.e..G.;(&..!.."0.Y......H7..x5...............!..w~.9.....{CL$.^\e?&c.l#B.7.W..*...+&.@.`!.!.4C.....\.}i....R.z.[v..L...@cL.6.B6)..|XZ>y:....hY.T.Y...K+..SnpU.$=...9P.........iY....}I...on.q...m.....MA...._u..!...-...P......-.....d.*0.K1...Nj9....m....f..V\.QK.W|7.r.......o..*^;..&2..].Ffu.\_.9'.oYnb..........t.2|....s...\.vYy@E.

                                                                        C:\Users\user\Pictures\Minor Policy\uusesdQ3Edo2k5kNA0mkf5gw.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):391502
                                                                        Entropy (8bit):7.166970852018235
                                                                        Encrypted:false
                                                                        SSDEEP:6144:DMscnF9k6mcRoe81qF3bbuAO20vCHI112hYo0KTw8yf:DcnFC0Rl81SfuvvCHI1mw8yf
                                                                        MD5:CEB2459748788BB810308BF0E0F4C4C5
                                                                        SHA1:7F7B241D108DF1E5C31EEDD07C52E780E07EAD1F
                                                                        SHA-256:F069656A5159C2BB61DFC6DD12E7C0526A71A5173ACA223EFD731047B06A08AC
                                                                        SHA-512:8208309C14120AD157C3200055B188D54AB7033B8B18B52F4A0510FDC47C4BD49C67F563A1C40B1FE07E17469AFD592E4AE1CBCA153CA630D9144691A28EF3E5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ....Z.(.q..rp.....Ws&.....}....yL..m..L.*$3Y.....m.@N......s\N. ....C..KN.Q....rf[....r..%.NP..)./..L.....*.>.#.........sg.^.J......zl>|F..,..7.....tI.j.c..0.[.$.Q.].s@.vD.-A.R......P._....@.-.p.....9.,6......}.$h....."..:z....w,....}oP.. .`..p`.S4 oe.y...r..!b.X....i%.=P3.9|.I.|"..O;/.;..'&.&....L....7K.&.9h....%"v.-i..qW....".U.&+,0!$..Y....j....g.{h.F..\.%H.jQ!.....R9H....(6..@.....)!.XC........'b..N..... ?....^..k.yy.,.A.Q,M!..h..C.W.).8.ZUX..}qoJ.='.*...uv...+FP...c.x2...n........&.C3-.N..K.!.x3....xr'.j..M.\.h4..cE.i.xJ...#.[N.mcG.. ..H..W_S.3.,*i.....O....V.qd&9*.7...........f{..W.+>.1.|.......'vL.e..G.;(&..!.."0.Y......H7..x5...............!..w~.9.....{CL$.^\e?&c.l#B.7.W..*...+&.@.`!.!.4C.....\.}i....R.z.[v..L...@cL.6.B6)..|XZ>y:....hY.T.Y...K+..SnpU.$=...9P.........iY....}I...on.q...m.....MA...._u..!...-...P......-.....d.*0.K1...Nj9....m....f..V\.QK.W|7.r.......o..*^;..&2..].Ffu.\_.9'.oYnb..........t.2|....s...\.vYy@E.

                                                                        C:\Users\user\Pictures\Minor Policy\w6vQnvc6GcufcSoPXxqtk9pf.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):479054
                                                                        Entropy (8bit):6.742396228412197
                                                                        Encrypted:false
                                                                        SSDEEP:12288:I4/1uEyNGaKRGfAJWhA42GlqbPcIIVcWnJzQsF:I4/7GhKRGfAJfXHLIVresF
                                                                        MD5:CC2C7C2883C7E71F35BCB18D1A0428D6
                                                                        SHA1:E1756814E747104C538D3E300178B2E515809FDB
                                                                        SHA-256:340AF78ECA475CA45A329A52B58C7F39908E9F6789DCC341E2E179E03794406F
                                                                        SHA-512:135AE41A46FBE9CD8CA7BED672221F437F07A2396A8CDC42AB5F8988636D8606DDA062939FB17C4370BFC5BC4291B6CE1C0641AFF81C91166EED1162AC2B7493
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ........@...H.P.3G.9.4.h../S..o9....E./B.l.....?....$.0:\n..w\.F.....!j[.|0..BWx.g\.G.@g.....]s.g....._...E....."1.F..xA....i_h$x.......(.c.u*...a..4YL)r..........0..:...X...o..H...xO....tFL:.. .&c.ms.bhk....?.......w.r#..sj1.bo|......m.....0;cV.!.) .........f..J....CL$.F=..b.a{+#.......q...0.V.+..Gg........N.ujN'-.c9....^.R...5.I^..Z.BG...........VfFe~O..W.th..i..,+........2'.$.k..&..\.$< R..v.[.=..."{wW..g./..\H...+..m.;...:.....o....C.9..D_.....*].WN..7h..sXY...-Y..N.Fp. .....D.s=_..W....xPjz!#W(.......y!.a....4{0.j..Mo....../p ....5..\.:..M ..m...[.|..{=..M.B...#m..dX.qR.............JN.....3B.$..o..O..|..)......p.tKkr0c...A..B....T.../....Y...i8.t>.y..y..D.VL......8.....8y....../_.0.K^Y...=Qf\.}i/.....Pu..f$......}..)..1#....$..0.RW..~......{.h.-.W..[...S.../.Z..,}..i.5...:X.8.{ILU...C./..9.....?..F..K.<.$.&.nXxv...X...o....g(....$........}.....D..q].+.PJ.t:.......&.Xv.ss.>.h.!.z%S.YC..... ...H..f.n.?.\W....W...L.Z..-.O..:....

                                                                        C:\Users\user\Pictures\Minor Policy\w6vQnvc6GcufcSoPXxqtk9pf.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):479054
                                                                        Entropy (8bit):6.742396228412197
                                                                        Encrypted:false
                                                                        SSDEEP:12288:I4/1uEyNGaKRGfAJWhA42GlqbPcIIVcWnJzQsF:I4/7GhKRGfAJfXHLIVresF
                                                                        MD5:CC2C7C2883C7E71F35BCB18D1A0428D6
                                                                        SHA1:E1756814E747104C538D3E300178B2E515809FDB
                                                                        SHA-256:340AF78ECA475CA45A329A52B58C7F39908E9F6789DCC341E2E179E03794406F
                                                                        SHA-512:135AE41A46FBE9CD8CA7BED672221F437F07A2396A8CDC42AB5F8988636D8606DDA062939FB17C4370BFC5BC4291B6CE1C0641AFF81C91166EED1162AC2B7493
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ........@...H.P.3G.9.4.h../S..o9....E./B.l.....?....$.0:\n..w\.F.....!j[.|0..BWx.g\.G.@g.....]s.g....._...E....."1.F..xA....i_h$x.......(.c.u*...a..4YL)r..........0..:...X...o..H...xO....tFL:.. .&c.ms.bhk....?.......w.r#..sj1.bo|......m.....0;cV.!.) .........f..J....CL$.F=..b.a{+#.......q...0.V.+..Gg........N.ujN'-.c9....^.R...5.I^..Z.BG...........VfFe~O..W.th..i..,+........2'.$.k..&..\.$< R..v.[.=..."{wW..g./..\H...+..m.;...:.....o....C.9..D_.....*].WN..7h..sXY...-Y..N.Fp. .....D.s=_..W....xPjz!#W(.......y!.a....4{0.j..Mo....../p ....5..\.:..M ..m...[.|..{=..M.B...#m..dX.qR.............JN.....3B.$..o..O..|..)......p.tKkr0c...A..B....T.../....Y...i8.t>.y..y..D.VL......8.....8y....../_.0.K^Y...=Qf\.}i/.....Pu..f$......}..)..1#....$..0.RW..~......{.h.-.W..[...S.../.Z..,}..i.5...:X.8.{ILU...C./..9.....?..F..K.<.$.&.nXxv...X...o....g(....$........}.....D..q].+.PJ.t:.......&.Xv.ss.>.h.!.z%S.YC..... ...H..f.n.?.\W....W...L.Z..-.O..:....

                                                                        C:\Users\user\Pictures\Minor Policy\wAxPBCpqdAy6VOZaVxomucuW.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):205352
                                                                        Entropy (8bit):7.716354649495604
                                                                        Encrypted:false
                                                                        SSDEEP:3072:ROeuPJHlsSzrYkwQu7lWzOB92CU7ZfxNG4mYbjw+Z5OZxqxZwO1CBemcT:keUaS4kwQugyyCU9JAyc+Z5OZxJgT
                                                                        MD5:F8ECB3612D38E7B7F1110718AF6B40E4
                                                                        SHA1:1844D45598EC9310B7A6ED0F7B7DC118AEFA8059
                                                                        SHA-256:CF3F8B2D4686C6FB481DCFE4150B7D48B8D3B04A2DAAF297693AD10241745F3A
                                                                        SHA-512:DB28A3DB35F44E011DCFCBEEAB9DDA724E16CD9120DE2908027ED6D8AA54A1380E5A971540BF75CCBB47164E262297B87F536CAB2EF910A14CA425B4759D9807
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<!DOC.w,... .%.9Z..|wK: ....R...uP.......`E...gR${.$.j...u..{....Vj.5Uj..&..I..e.7Q...8........l...(p..;....."~.s..|Wn....G..hjA..:.....[.y....[x`..w.>..)pH..g@bW...Ao=h..<Cjr.<...z..#>...N.. .....x....y....u............2.Ln...S......>.....[.=8.Cy..9.`Rc.Hu..Ia+>.......T.5...S.A.{Yq...p.h..$. .o(...Ms4..+...X.".u.......Q........X....%..F....G.?.];..}..D..(...:F.1...w..=,....3.t3;S82b.J.C.X.-.../.....Z.M....*.f%.ih....6.h....[.ON..r.8.1...w....F|.....!..7..^..q..%$=...#.b>...A.8......aIc.'M.6.OcT..%aO+. zDX..2.....S..G.8_p.#...KBv{n.rsH.{\^....?}]...."s...%........k.?y+..ZN..,.]....XZ.\...c.uC".. .>fv.2.l..Z..l0..R..~"...|..X.h.E-.~.Y..O..!FL.....J.?.J.Y9.....N1...:......:..=...=.E.]..YG....Y..TT...i.......+!........D[<Q;..8XoJ....".8k?..%.6..zT%j..Lf....c..DZ.....y.}s.....e\..i{.....q...Y..'I.G.%.6...E...c..Q,.D...e....w...0...m....""b...mK..H..%x3..nA2....:d.K....Y,a`.Lr.Iud.@.?.rS.......yU._.......6.&.1.y.C...k...0....c.~.(.7....Hg...?.g.%.

                                                                        C:\Users\user\Pictures\Minor Policy\wAxPBCpqdAy6VOZaVxomucuW.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):205352
                                                                        Entropy (8bit):7.716354649495604
                                                                        Encrypted:false
                                                                        SSDEEP:3072:ROeuPJHlsSzrYkwQu7lWzOB92CU7ZfxNG4mYbjw+Z5OZxqxZwO1CBemcT:keUaS4kwQugyyCU9JAyc+Z5OZxJgT
                                                                        MD5:F8ECB3612D38E7B7F1110718AF6B40E4
                                                                        SHA1:1844D45598EC9310B7A6ED0F7B7DC118AEFA8059
                                                                        SHA-256:CF3F8B2D4686C6FB481DCFE4150B7D48B8D3B04A2DAAF297693AD10241745F3A
                                                                        SHA-512:DB28A3DB35F44E011DCFCBEEAB9DDA724E16CD9120DE2908027ED6D8AA54A1380E5A971540BF75CCBB47164E262297B87F536CAB2EF910A14CA425B4759D9807
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<!DOC.w,... .%.9Z..|wK: ....R...uP.......`E...gR${.$.j...u..{....Vj.5Uj..&..I..e.7Q...8........l...(p..;....."~.s..|Wn....G..hjA..:.....[.y....[x`..w.>..)pH..g@bW...Ao=h..<Cjr.<...z..#>...N.. .....x....y....u............2.Ln...S......>.....[.=8.Cy..9.`Rc.Hu..Ia+>.......T.5...S.A.{Yq...p.h..$. .o(...Ms4..+...X.".u.......Q........X....%..F....G.?.];..}..D..(...:F.1...w..=,....3.t3;S82b.J.C.X.-.../.....Z.M....*.f%.ih....6.h....[.ON..r.8.1...w....F|.....!..7..^..q..%$=...#.b>...A.8......aIc.'M.6.OcT..%aO+. zDX..2.....S..G.8_p.#...KBv{n.rsH.{\^....?}]...."s...%........k.?y+..ZN..,.]....XZ.\...c.uC".. .>fv.2.l..Z..l0..R..~"...|..X.h.E-.~.Y..O..!FL.....J.?.J.Y9.....N1...:......:..=...=.E.]..YG....Y..TT...i.......+!........D[<Q;..8XoJ....".8k?..%.6..zT%j..Lf....c..DZ.....y.}s.....e\..i{.....q...Y..'I.G.%.6...E...c..Q,.D...e....w...0...m....""b...mK..H..%x3..nA2....:d.K....Y,a`.Lr.Iud.@.?.rS.......yU._.......6.&.1.y.C...k...0....c.~.(.7....Hg...?.g.%.

                                                                        C:\Users\user\Pictures\O4TFp27C2n3WSIh4cH9WqD5A.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\OoqQROwr1Yg6cLi95suPlaEZ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):1534806
                                                                        Entropy (8bit):6.967020058565602
                                                                        Encrypted:false
                                                                        SSDEEP:24576:zfCIwNo7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9Y:4Nq5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA97521F662B3F782FDA144C5DD4EEA2
                                                                        SHA1:DFE7A1DCA12CA4A42F120587C36422D9B729D010
                                                                        SHA-256:2EB3B511D55BC7052F7854D27AA8DB336265430FD68D8FC48706E822BD830703
                                                                        SHA-512:D763CBB3FCC2DE11F18034918F51D4280E16556B0BEE1DCB3B5ED3D08E4B3D2A7A1570454C32B270119E8FB950EF31860472C6DE6B2BE4612D5A4B2AA4D1AE1D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ....j.e2...G...5..w....@.J_.`...U...q...N.......Q.......m..h...L..M<!....d..F...$`]...H.Qv.`U..&"4.O'...RQ....b..p`[....1....~G.8'bO....s...Ca.rNL5.!'....2W.xz.7\.......g7...V=.'5..S%..V'(..[q.#.n._...1G.`d....}.&......+9@..8...3....~#...)../...... .&.%j/.w.6.9n..!;Ye.6p..k\_{.I.....m.n..fR..8.."U...... .....N._.Q5.R....M...(5.u..^.g...H..;....Ghn...>._..Mm.s.JDO.f.0.R8.K.d.L..S.....prF.$d..!_Z..e......Y.c7...b.;..[...$._$?Sc..........7C...:>.?!..)?...Q.n;;...S..]..../..C.........Ct.5..Z.c..0.[.>-..^.ao.)..........Kg.$cs.F82.zG...u.>.../Fsy..Xw>o.g_.v6..$..;.9...........`^.L..|N.P..S?...n..S.....N..B`..........e....E........t~.?.;.k..Y7.VU&..>.TG ,.....4.u.....Ip)..]#.F.x.....^e...=..X...Ro.~.E`.Q#..NQ..-.ACZ.2x....V...{N...a..'.....V-.N...2L..3..~/...]S..p...%`y5..``.6...b..9.0n..E.........|..m.....4.I.w..vx5_C...Y. .@Kk....*.G.S...[..^......G..<...Rr..l..V......q.b....(..N).1.&8.+.......\..(y..OP...]..5l.....!k)>{.A $Sw.H0.Z..........Zs~....

                                                                        C:\Users\user\Pictures\OoqQROwr1Yg6cLi95suPlaEZ.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):1534806
                                                                        Entropy (8bit):6.967020058565602
                                                                        Encrypted:false
                                                                        SSDEEP:24576:zfCIwNo7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9Y:4Nq5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA97521F662B3F782FDA144C5DD4EEA2
                                                                        SHA1:DFE7A1DCA12CA4A42F120587C36422D9B729D010
                                                                        SHA-256:2EB3B511D55BC7052F7854D27AA8DB336265430FD68D8FC48706E822BD830703
                                                                        SHA-512:D763CBB3FCC2DE11F18034918F51D4280E16556B0BEE1DCB3B5ED3D08E4B3D2A7A1570454C32B270119E8FB950EF31860472C6DE6B2BE4612D5A4B2AA4D1AE1D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ....j.e2...G...5..w....@.J_.`...U...q...N.......Q.......m..h...L..M<!....d..F...$`]...H.Qv.`U..&"4.O'...RQ....b..p`[....1....~G.8'bO....s...Ca.rNL5.!'....2W.xz.7\.......g7...V=.'5..S%..V'(..[q.#.n._...1G.`d....}.&......+9@..8...3....~#...)../...... .&.%j/.w.6.9n..!;Ye.6p..k\_{.I.....m.n..fR..8.."U...... .....N._.Q5.R....M...(5.u..^.g...H..;....Ghn...>._..Mm.s.JDO.f.0.R8.K.d.L..S.....prF.$d..!_Z..e......Y.c7...b.;..[...$._$?Sc..........7C...:>.?!..)?...Q.n;;...S..]..../..C.........Ct.5..Z.c..0.[.>-..^.ao.)..........Kg.$cs.F82.zG...u.>.../Fsy..Xw>o.g_.v6..$..;.9...........`^.L..|N.P..S?...n..S.....N..B`..........e....E........t~.?.;.k..Y7.VU&..>.TG ,.....4.u.....Ip)..]#.F.x.....^e...=..X...Ro.~.E`.Q#..NQ..-.ACZ.2x....V...{N...a..'.....V-.N...2L..3..~/...]S..p...%`y5..``.6...b..9.0n..E.........|..m.....4.I.w..vx5_C...Y. .@Kk....*.G.S...[..^......G..<...Rr..l..V......q.b....(..N).1.&8.+.......\..(y..OP...]..5l.....!k)>{.A $Sw.H0.Z..........Zs~....

                                                                        C:\Users\user\Pictures\P94EhV34EPtPaMGwUp1MdOBl.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\Pictures\PQupt0HW1Hr6CvQnLIpAX9Nn.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\PWW3NllpNWDgvXFV7Tah5Tq9.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\PgD7qvCHGXafJKVwvHiAw9cK.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\Pictures\Qf1uzkxmrsAEWK29C7uEFmrZ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\RMGQS3F1UiPheVnWeV2JpDqL.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\RblTvSwpBJ357KsApRz6smyw.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\Rh0zrbuPE23tmioMFpoeQvyq.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768503238619159
                                                                        Encrypted:false
                                                                        SSDEEP:49152:5+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4va:kwrGHip8nfzyeJaipzW88gLva
                                                                        MD5:F5DA6EBF1248A64E02DA6C513A22929A
                                                                        SHA1:DE5379E44DF789AF6AC843416A7A7436CF9EF499
                                                                        SHA-256:32C570DEE9893BC6DFE99FF86EC73B1AD942F67AD14F8EE44298280CE77B25B9
                                                                        SHA-512:918ADD37161E2080FFF2DFA0C13EE02BCD2CAEBF526970A60CD592E4F251F7122C719E34B61A69A5731DEE62ED75C0742E0D13FD4CE21FBD9E92B338983888E5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS.......-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\Pictures\RhAMzHnnu31IkY36iE1sZ1J2.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\RoYVZz1e4yTRTjOZHXj4zqUM.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\SGRGSrOrLAvbIwSiEaRMIm3Y.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\Pictures\SPpYvykupaNYuUQqOkv0xHw6.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\Pictures\TDwHwUnikC3d4IvKdWZ8TN8E.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):3234126
                                                                        Entropy (8bit):7.9896414371058
                                                                        Encrypted:false
                                                                        SSDEEP:49152:Bpv8zYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddNV:kTi++Ql4FEQaxuMBh/DqLddT
                                                                        MD5:206CC6FF8CC3BB94BC539E1341FEC417
                                                                        SHA1:289692163B784835D9942AD6CB1F1B9D14A0799A
                                                                        SHA-256:9BA23DC6F21384BC8FE0F293B7F758CA967EB915BE046E8F3D75DE4A6CD5D594
                                                                        SHA-512:EC7AC2897A88E80EFCACD518953CA1F54B97B5B9D1634BCA69DF7E39EF3D39F19A4BD9E2EE856196D3511A733A188812BAE8C271919337BEDF3CEB7DEF85E99B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ..../.@....1.x,K7J%...E.u...Vv...z&H...&[.....(.x.......3?..8../.c,Nl......r.GY...5.9.M\y...K$........f.]..W.X..i.K)....{..pQ....<...v..U...u:..?.r..+S....m..r.2..pZ.RB....8y....P.1..1`...K.-............U.......m....8....-....4..D[..M..J.b`z...W..c.....ru5.I.@.....jO.~.d1..._Jg.J..,.Q'.J..(....R.....f0..Z.=.N..TE.,z..@.v<T..... kK\..&.YRs3.a..:...[L.T..1-.MN{.3.(.3..}.....c...C6......o...hc..L0.`N.:..;.C..pp....c..q...?..V^....`.......m.......v.A...U...y.g....I.l.a.o6......r._..[..JeY0.8..?5..XX.7.........^?d.y..K......:.X_...$o...Yq.9%..}..m.7.M...m-..p..{n...h.E...M.n..=-6..m.`m.x.........z.....g...'L.H"....>B5..)..Z.lT%_..V..Z.....&._k....Rs3...L.]Y.&_.R...K.w..!.R.I./-....a.........g.0.....a.{....&..=-.|`...IM..$.n.o(..bR.9...A.s.|.J.W.A".Y.:......N..v.!]@.a...P...........~.Y./lb..ha#..c.}.V.....|x..G..#B...6zZ.G.b.....aF..(......Vz;..>u....!t.....ZFU..r......2]X.*..RCQ#`.~w.......D...U....)WhR&.\......;Dc.... 0.^.9.I._.}.O

                                                                        C:\Users\user\Pictures\TDwHwUnikC3d4IvKdWZ8TN8E.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):3234126
                                                                        Entropy (8bit):7.9896414371058
                                                                        Encrypted:false
                                                                        SSDEEP:49152:Bpv8zYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddNV:kTi++Ql4FEQaxuMBh/DqLddT
                                                                        MD5:206CC6FF8CC3BB94BC539E1341FEC417
                                                                        SHA1:289692163B784835D9942AD6CB1F1B9D14A0799A
                                                                        SHA-256:9BA23DC6F21384BC8FE0F293B7F758CA967EB915BE046E8F3D75DE4A6CD5D594
                                                                        SHA-512:EC7AC2897A88E80EFCACD518953CA1F54B97B5B9D1634BCA69DF7E39EF3D39F19A4BD9E2EE856196D3511A733A188812BAE8C271919337BEDF3CEB7DEF85E99B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ..../.@....1.x,K7J%...E.u...Vv...z&H...&[.....(.x.......3?..8../.c,Nl......r.GY...5.9.M\y...K$........f.]..W.X..i.K)....{..pQ....<...v..U...u:..?.r..+S....m..r.2..pZ.RB....8y....P.1..1`...K.-............U.......m....8....-....4..D[..M..J.b`z...W..c.....ru5.I.@.....jO.~.d1..._Jg.J..,.Q'.J..(....R.....f0..Z.=.N..TE.,z..@.v<T..... kK\..&.YRs3.a..:...[L.T..1-.MN{.3.(.3..}.....c...C6......o...hc..L0.`N.:..;.C..pp....c..q...?..V^....`.......m.......v.A...U...y.g....I.l.a.o6......r._..[..JeY0.8..?5..XX.7.........^?d.y..K......:.X_...$o...Yq.9%..}..m.7.M...m-..p..{n...h.E...M.n..=-6..m.`m.x.........z.....g...'L.H"....>B5..)..Z.lT%_..V..Z.....&._k....Rs3...L.]Y.&_.R...K.w..!.R.I./-....a.........g.0.....a.{....&..=-.|`...IM..$.n.o(..bR.9...A.s.|.J.W.A".Y.:......N..v.!]@.a...P...........~.Y./lb..ha#..c.}.V.....|x..G..#B...6zZ.G.b.....aF..(......Vz;..>u....!t.....ZFU..r......2]X.*..RCQ#`.~w.......D...U....)WhR&.\......;Dc.... 0.^.9.I._.}.O

                                                                        C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\Uj24luzqBnidcXyEK0ccsV0u.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\UzLedM0ee5YrMMtYu5jpiusG.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):341
                                                                        Entropy (8bit):7.20948212738006
                                                                        Encrypted:false
                                                                        SSDEEP:6:YPrsmRfZmYyb/Q72+IgMjdUSEqW/rxeF597H3nscfgpfWcii96Z:YPomlZmHW2EMjdv1W/N697XnOWcii9a
                                                                        MD5:C3DCA0F514D5D5D0800BEB3142193D7F
                                                                        SHA1:D3130C07447DAAD331A4A69C20C8CBCB7A5D8DDA
                                                                        SHA-256:37A46E6ECC33BE44901A0D26E793CA24C5ED50E929B0F3280F740CA9EC502091
                                                                        SHA-512:938A71AEFAA3B0632E1BDCE1C93B4A0DAC27674F24D0AAD6AED6C187C9D0C4F01730E9A61946C17C283D46F9E172E578E5D291196FDE7B733C6ACEA6569BB9D4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expir..n.:....m.B.P..|..H-~?g.:CI..\..8..h...........m.4.+..:..T.6..^../..S(...o.-........i...L.L......j..5x+...N....ADM.i}We.G..tM9....C..7..aBdS*.JD......m.............Er...X2k.T9"I..!..-....t90}..x..hqo...T.'`..l..g....n.Y....5.N...2...S.....^`.9...../lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Pictures\UzLedM0ee5YrMMtYu5jpiusG.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):341
                                                                        Entropy (8bit):7.20948212738006
                                                                        Encrypted:false
                                                                        SSDEEP:6:YPrsmRfZmYyb/Q72+IgMjdUSEqW/rxeF597H3nscfgpfWcii96Z:YPomlZmHW2EMjdv1W/N697XnOWcii9a
                                                                        MD5:C3DCA0F514D5D5D0800BEB3142193D7F
                                                                        SHA1:D3130C07447DAAD331A4A69C20C8CBCB7A5D8DDA
                                                                        SHA-256:37A46E6ECC33BE44901A0D26E793CA24C5ED50E929B0F3280F740CA9EC502091
                                                                        SHA-512:938A71AEFAA3B0632E1BDCE1C93B4A0DAC27674F24D0AAD6AED6C187C9D0C4F01730E9A61946C17C283D46F9E172E578E5D291196FDE7B733C6ACEA6569BB9D4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expir..n.:....m.B.P..|..H-~?g.:CI..\..8..h...........m.4.+..:..T.6..^../..S(...o.-........i...L.L......j..5x+...N....ADM.i}We.G..tM9....C..7..aBdS*.JD......m.............Er...X2k.T9"I..!..-....t90}..x..hqo...T.'`..l..g....n.Y....5.N...2...S.....^`.9...../lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\WMMeMLRqjSsdlkGClauVg3Va.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\Pictures\WzFp4Ue0aRPtu9AGKLArlpQs.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Pictures\YXm3NwMNdpjawwYFNXTrNGEs.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\ZOi0qzxm5CX6wQOzSpSM9xKZ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\Zm8A45fXl2ofLOUYJkU9Hc7y.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\flZM696vxwchmoky86e6PuiE.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\Pictures\fyRhz339Pv56oNzsjdndKi51.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\gTtQqHKsFf9Nsh1JcOtwF10p.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\Pictures\gcwSzukTSrGmCgHPurGZSV7G.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402064
                                                                        Entropy (8bit):7.940343393586599
                                                                        Encrypted:false
                                                                        SSDEEP:98304:WV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:lpBNW91wVrN36e+uJiPlG
                                                                        MD5:659F20996F8E561EDEF3227A4407A3C8
                                                                        SHA1:CBB236FB65DCF77FAF29E74CC1493D05B8E9EDFA
                                                                        SHA-256:7A1F65FD42A92AA41343ED691E2419BFC54E1E55F09CFCC15D4B7313B3A96C4F
                                                                        SHA-512:8FC54E902FCC746995DAEA48AC832049CF2BFA1F4BA01E91E29297C881FB2A4904931B0F30F23EC971F5B266E5F9ECBF14A43680FF9F4BEA205E565A3675A9E0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\ghXDF7wc1k0lMAVWTQE9mN9d.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):7541907
                                                                        Entropy (8bit):7.995914380010542
                                                                        Encrypted:true
                                                                        SSDEEP:196608:91OS1yrWGZGPpt5JZR9hGr9+fCTiE6iAhDKyd:3OoSDA3JZR9YRyCTJ6iqXd
                                                                        MD5:9CB4B92F6B0EEF1A38D3DCF3C8FF9757
                                                                        SHA1:CF2B0790F9294D031638B773736B981238228866
                                                                        SHA-256:C64C495EA57849D9CB866161A2D778DB143512F546385B6539BCD5018092AC34
                                                                        SHA-512:43B1AF48587F45EECF432B1D454B08436431CFD1C615228BF192DADF453B3B54742B3ED49C99EF0B1A0BC069AA5D14201E766FE36EA0BECF331617F519045EC8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\grenEgiZiRLW7ypJuIUqFvJB.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Pictures\h3Dv4eVFYvFjMwVMds5pUrWs.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\iTvsD7rneILjrgO7TrPXhsJG.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\Pictures\jNWzuOIBQ0iWSRmcZK1mILW4.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Pictures\l4NNL3d0gUhzOZ4YXgbQgdkt.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\Pictures\lPklOteJSGW2ZOcLzoL339u4.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Pictures\mbsmLcWDGIknMhQtAUGQxRi5.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3233792
                                                                        Entropy (8bit):7.9866868628424035
                                                                        Encrypted:false
                                                                        SSDEEP:49152:K/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:K/FTi++Ql4FEQaxuMBh/DqLdd
                                                                        MD5:823B5FCDEF282C5318B670008B9E6922
                                                                        SHA1:D20CD5321D8A3D423AF4C6DABC0AC905796BDC6D
                                                                        SHA-256:712F5BB403CA4ADE2D3FA47B050AAC51A9F573142FD8BA8BF18F5F8144214D8D
                                                                        SHA-512:4377D06A71291BE3E52C28A2ADA0B89FF185A8887C4A75972CDC5E85D95DA6538D1776BC49FB190C67B8E6497225F1D63B86793F4095C8FB990A5F6659216472
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."1..4......2A1.. ...`1...@.. ........................1...........`..................................@1.O....`1.00....................1.....H@1.8............................................ ............... ..H............text...8!1.. ..."1................. ..`.rsrc...00...`1..2...$1.............@..@.reloc........1......V1.............@..B.................A1.....H........N..85..........P.....0.........................................z..}.....(.......(......(.....*6.r...p(....&*....0..X.........{,...(....o.......+9.(....r1..p..X...(....(....o....(....r=..p(....o.......X.......-.*.0..4.........{.....o .....(!... .....s"...~#...($.......o%....*&..(&....*...0..+.........,..{.......+....,...{....o'.......((....*..0..+$............()...s*.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s+...}.....s,...}....

                                                                        C:\Users\user\Pictures\mqdlYa5XIp88le49pQN6WBpM.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\Pictures\nG1N9nGRo8GAvgDDfFLRMM5E.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):388096
                                                                        Entropy (8bit):6.051227739620757
                                                                        Encrypted:false
                                                                        SSDEEP:6144:CsURDnkqygQwEGZ3ac2LwMkA15AW1cBmRL1Yh87A2tusOm+Nae:C/DkngjJ2AqxYh8XusGb
                                                                        MD5:E4FA45F80EC75D24124D434010023355
                                                                        SHA1:D495157BA5FF2408B7EF2A1AD6BE1B3C55BF7A1A
                                                                        SHA-256:C6D7D32807A9342D95E865E9828CF214722A097EC3F903FF8225D5A2E9C257C2
                                                                        SHA-512:717119CB492E9B9818BC86B436ADB67ACDFB4F08E0CCDD666B7B148A01969C18A8DA8BB083D7C86DC4A4857871FC8537CF33E49C75CC189FA3A40442542FB7BA
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#uN)g. zg. zg. z.Z.zf. z.b.z}. z.b.z.. z.b.zA. znl.zn. zg.!z.. z.b.zf. z.b.zf. z.b.zf. zRichg. z........PE..L...sw.b.............................T............@.......................... ......S.......................................T...d....0..P...........................................................XB..@............................................text..."........................... ..`.data...DL.......>..................@....rsrc...P....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\ofTwW0taLmfnIjaVOqYoqMFx.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\Pictures\q1a6Hdte5ZphUujirBwwpHRY.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768505745291893
                                                                        Encrypted:false
                                                                        SSDEEP:49152:n+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vT:+wrGHip8nfzyeJaipzW88gLvT
                                                                        MD5:2A5485871D21C57833C57807B59A6B18
                                                                        SHA1:255228C692227894F61349ABDCE5851818D0B15E
                                                                        SHA-256:90E8C59057DBA0DFF3979489AB59C2F67ED50CE204CA61FE13142B75C4EDDE1D
                                                                        SHA-512:CF3ECACC783CE393870B78ACB1B1398ED077423341975933ECE6E62FAF3795F334606055D428B22CD4BC1D30B7831DD2BB290C73F9C7CD10BFDD5016B8D91243
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......A-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\Pictures\qX5oeRRpM2S4qHilS3yTr7sq.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5550656
                                                                        Entropy (8bit):7.908253498321113
                                                                        Encrypted:false
                                                                        SSDEEP:98304:PkLCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAH6:0NoYtLaC2eWMuwyy3tPj9AFa6
                                                                        MD5:3E74B7359F603F61B92CF7DF47073D4A
                                                                        SHA1:C6155F69A35F3BAFF84322B30550EEE58B7DCFF3
                                                                        SHA-256:F783C71BCB9E1FB5C91DBE78899537244467DBFD0262491FA4BC607E27013CF6
                                                                        SHA-512:4AB9C603A928C52B757231F6F43C109ECCE7FC04AA85CDF2C6597C5AE920316BF1D082AAE153FE11F78CB45CA420DE9026A9F4C16DD031239D29A1ABB807CE05
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................R...^.......^.......p....@...................................U...@......@...................@....... .......p..............@.T..)...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

                                                                        C:\Users\user\Pictures\qvQF1TKYhYFFgSpHGD6rgb7v.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):6746904
                                                                        Entropy (8bit):7.910522519291633
                                                                        Encrypted:false
                                                                        SSDEEP:98304:E5KHS3HqsObIKG9fiJs1PzvNYgBI3SVkDqxH+HLLhCwND9d9n4dURFmeRQ2sqKZ:E4SXqzjYf+saZSVMqhmLoYnwUR0qQ/Z
                                                                        MD5:2CCBE06BD3095DEB53A66595C3E18603
                                                                        SHA1:DD27CDEBB3F84DA4C621D3AF1122F11E71980040
                                                                        SHA-256:71B140A7235F94722CF967AEF9AFCD8E3E10266A4B8D015153DDDC46ADDB953C
                                                                        SHA-512:D51B8C68C33BC2A61AE62A5069840F4457D8D11FBC14A523BD07EF164C0573454FE3E4533A5E014EDB58F5E2D46F22C974084027002F5ED3675C5B0BBC00E467
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*l.d..........".......0..`......D..........@.....................................|g...`.....................................................................[....f........................................(.................................................. ..0......................... ..` v.....1.....................@..@ .$....4.....................@... .W....6.....................@..@ .....p7.....................@..@.7-Zip0.......7.....................@..@ T&....:.....................@..@.idata........:.....................@....tls..........:..........................themida..A...:.....................`....7-Zip1..R...p|..................... ..`.7-Zip2............................@....7-Zip3...e.......e.................`..h.reloc................e................@.rsrc.................e.............@..@........

                                                                        C:\Users\user\Pictures\qzThW72RYcWSkAonVKQR5Zam.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):4402398
                                                                        Entropy (8bit):7.9475158990071755
                                                                        Encrypted:false
                                                                        SSDEEP:98304:06pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:/pBNW91wVrN36e+uJiPlG
                                                                        MD5:1264B47D59ABCC2FE912CFDC2E296285
                                                                        SHA1:CBB1B7BDCF8E3545AB118B2D37BF7569413E3BA5
                                                                        SHA-256:D40F59266706BAAAA0C5DB16E5BE1CAB04ED612B71434E4439FDD3A46FBAAB3F
                                                                        SHA-512:141BC1B41BB63EED2BC65ED981FBF57AE1C4011EC555CB634262921D1B36B6AD623DE724A31AA47A528B248994683E3B8F26CD6F01CE0A93F886E5B5DD431EAD
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...N....~B.....zXT..El..>o..C......4.....B."I....v..C.\:....0.LG....."bGKT,8Pa.n@.....'_.y..?......cPDf...f..\..q..q...6.=...B8.@a.Y.8..-..E.#)e.j..f.].... ../@.....B..A..eF..}...NQ.................B.....9".9@...T~..FX#...h...s.u"..9.?.7h.._[c.1=+[.%..=#[...l.OY.1s...5.n.......W?!uON..v.s....ekL.j..{]=.B.V...CJ_l&.[=....I+W.Rcv...b...v@.R.6..,M&f...ZwW.".].].Ex.....[@T..:Y...j2..R.%.^M.......z.....;...:@a...~.v.k.jd...b}..?.A.<.$.y...._.*.HKE.:.c43t_#..+.u.\..uBW.h...'.M:..={ ......-n.E.....z....B..).......k.o....3....Q.."0cx.G....,./.-'.?.de..,.D\..$.j..W.n........ .-Td..e.}.Y........*Ff.~w.../.......%SY.%....:k/.!v...tK..D.B....b!...f7U...|W.d......8.~.0..{.Y#.|rB.........X....}z.[.B..U...g..l.....9(/....."...;......68.}c...#*oF............F....].1......[@..Y.....f.j.'\;..;.Nk.d.\5QO.b.X......M...8d.lI.7%`.R.=...=..pa..B&%../.I.......q=[...0.S....Dx.6X...x.O......$TT.#...D2K...k-Ax....U..t>i.{.x.`y.\;."FQ....,E.|.....q..!)...lg....Y.

                                                                        C:\Users\user\Pictures\qzThW72RYcWSkAonVKQR5Zam.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):4402398
                                                                        Entropy (8bit):7.9475158990071755
                                                                        Encrypted:false
                                                                        SSDEEP:98304:06pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glG:/pBNW91wVrN36e+uJiPlG
                                                                        MD5:1264B47D59ABCC2FE912CFDC2E296285
                                                                        SHA1:CBB1B7BDCF8E3545AB118B2D37BF7569413E3BA5
                                                                        SHA-256:D40F59266706BAAAA0C5DB16E5BE1CAB04ED612B71434E4439FDD3A46FBAAB3F
                                                                        SHA-512:141BC1B41BB63EED2BC65ED981FBF57AE1C4011EC555CB634262921D1B36B6AD623DE724A31AA47A528B248994683E3B8F26CD6F01CE0A93F886E5B5DD431EAD
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...N....~B.....zXT..El..>o..C......4.....B."I....v..C.\:....0.LG....."bGKT,8Pa.n@.....'_.y..?......cPDf...f..\..q..q...6.=...B8.@a.Y.8..-..E.#)e.j..f.].... ../@.....B..A..eF..}...NQ.................B.....9".9@...T~..FX#...h...s.u"..9.?.7h.._[c.1=+[.%..=#[...l.OY.1s...5.n.......W?!uON..v.s....ekL.j..{]=.B.V...CJ_l&.[=....I+W.Rcv...b...v@.R.6..,M&f...ZwW.".].].Ex.....[@T..:Y...j2..R.%.^M.......z.....;...:@a...~.v.k.jd...b}..?.A.<.$.y...._.*.HKE.:.c43t_#..+.u.\..uBW.h...'.M:..={ ......-n.E.....z....B..).......k.o....3....Q.."0cx.G....,./.-'.?.de..,.D\..$.j..W.n........ .-Td..e.}.Y........*Ff.~w.../.......%SY.%....:k/.!v...tK..D.B....b!...f7U...|W.d......8.~.0..{.Y#.|rB.........X....}z.[.B..U...g..l.....9(/....."...;......68.}c...#*oF............F....].1......[@..Y.....f.j.'\;..;.Nk.d.\5QO.b.X......M...8d.lI.7%`.R.=...=..pa..B&%../.I.......q=[...0.S....Dx.6X...x.O......$TT.#...D2K...k-Ax....U..t>i.{.x.`y.\;."FQ....,E.|.....q..!)...lg....Y.

                                                                        C:\Users\user\Pictures\rdOeLIubzEtA5kaQGojFXfzi.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.768505936227056
                                                                        Encrypted:false
                                                                        SSDEEP:49152:7+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4v0:qwrGHip8nfzyeJaipzW88gLv0
                                                                        MD5:B60798160BDEF2489816A87DC1526D92
                                                                        SHA1:8ECAFF687658E70AB2F49D710A91F3006EB4C7FD
                                                                        SHA-256:F974E0DABD6D8AE8F6B613D6B48C00871DD71BC68FA994892CFE543FB7988780
                                                                        SHA-512:4B49B88D9729247923B4EB3653DE4F93E67640E55335B8405FCA3E82A22A4F65BE2CF274DED521A90CFDF35ED0BC20F9B24CCD1FB405BFCF75D134CCE8DA7D5F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......[,...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\Pictures\sXkL3LKFhhFZp9IPDF60kufQ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):312832
                                                                        Entropy (8bit):5.4160048970126535
                                                                        Encrypted:false
                                                                        SSDEEP:3072:b1B8qN0Mh5a9v0GO+vlz9/P/6fo7sD1BguZdfkSNtxl4gpkSsMtk0lvS:BB840y5a98G1z9nSTEuPcSNtP4gpk+N
                                                                        MD5:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        SHA1:95682D6D8D954D837C9503C148F2857C6A9B7AD7
                                                                        SHA-256:5B809F3E90F2DC84E3A042EF1F54169331288D600A020E1CC445BD56781514DB
                                                                        SHA-512:8FB925C9D06AA82E05FD9E2A0E84C91A8073088B1D101048363513F114C6D332C9295469E719C2B662AA293824BF527BB42367F85E39E799AE280F4EEA5787DF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L....!Hb.............................T............@.................................. ..........................................d....................................................................B..@............................................text...n........................... ..`.data...$L.......>..................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\soa3mGK83PMJk1RZrnayLoiR.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\sx6CAqB8jM442sOUtkHOeTiz.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\Pictures\szKukjqbkrhlE2n6dTEMyu9d.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                        Category:dropped
                                                                        Size (bytes):2903928
                                                                        Entropy (8bit):7.7685046761933085
                                                                        Encrypted:false
                                                                        SSDEEP:49152:i+wK8GHrzRfcqwDTfh+a9PUnYnqXf/z25ee0JKqSS3jFzWo/Gu8gc4vr:1wrGHip8nfzyeJaipzW88gLvr
                                                                        MD5:78FC8307D52820455467A39DE937A290
                                                                        SHA1:2ED136E0ECC5A5932F5DD2D590ABCA5A9FDC58C9
                                                                        SHA-256:77903CEAA56B058B232D6AA206ED08E6326C63FFB0DEF5FC5E0EF52DC7C9D657
                                                                        SHA-512:654D50EFBC8399B3620250FE85855533A6A9700C3C51D63036D760577DC3185A1B641AEB3A2B79C078353211813541687CD0A2ACA43BC96FC6F2F8CAB01138B8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e..........".......+.......'...R.. '...R...@..........................PS......5-...@..................................@S.......R.............$,.x+...AS.............................t.R.......R.............................................UPX0......'.............................UPX1......+.. '...+.................@....rsrc.........R.......+.............@...4.02.UPX!....xA.\...s.R...+..&R.&...a.!.U..]....U..1.]........WV....x ..............u.....1.H^_].F..H..N......:.....?SWV.....U.b..B.......B.....d.....d...........J..|...tY.E..).E.R..E..|.......u7.u..L.H..uT.E...t.....x..E.-.\7.....Q.....t>.M...."l.E..M.d.w...^_[]..}..........76...\....j..P..U....@.....D.....P..c.! \.f.....6.UPK=..ak...]...e...PH...p.:.*......Cp.b5<.?.....M..E.`..@@@...w..d.D..}..~..U.1..:.M.).....)...9..L..Z9.r.9.wv.4.VPR.M..............p..U...;}.}@.M..A..Y.9#.o..r.......X$

                                                                        C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):313166
                                                                        Entropy (8bit):5.841507650976253
                                                                        Encrypted:false
                                                                        SSDEEP:3072:jyMvpjqlLugT1M+eyAIGJ91Dl9q/pa2RE8pxUDtUQZ1FSsMtk0lvSv:jyMlqlBJM+G7/WBaCE8wZUgj+N6
                                                                        MD5:AA2400153641C9E6C0841F0DC8E898CA
                                                                        SHA1:685E7A7AE9A756BDAEA7AAC931E5A43741D0E471
                                                                        SHA-256:3AB7354739E460ADC9C56447706B1F0A0E19BDFD70D9D471C32C771D55D6352B
                                                                        SHA-512:C448BF4B83703FD1193E6681E81AE343BFCD712C2E7300C71B8EA8E885FEB62E86C490199BC382526D35F7DB84657499F412420390EAF904BB499576DF3C6EB9
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ........X.90...]}.S........%2..Y/u.1...x..o.R"..n..9l..UR...oxR..5.SJ..n%.....f.o3/..K..-..........S..H.mr.^..B.U..aE.SK}T.)..#...;.s|..YK1..x.=..C.^...dX....a..C;.8@V<.Yd./kPN.......z..s.z...u0.}5....N...2.......u.7TY.d.]j%..Mp......}....k..S.]z....b..d..}......5..s.1..$=......o!.).....s.../..v.H_z.6..O]..q[.j....f.g.d.I.n.Y..A'0.....,...P...... |..s...N7-A..C...L......nWnEs.yL&..I.j.U..z|*..:......s$...<2.oh}2p..J....V.r.........>...CF.8..|s|B....U.Q.Q..S.=z..%....zP.Sr.}..C5.`..V.3....4xj.]3.T..=EXZ..D.......\.....B.j}}.p..L6..'?.7Y...]5u.b..D9...5...S*..f%..kF...2..8...d.)F.#.mbs.l.G@.:...j.1.I..X...kY.(..N@#b.H..>.....A.R...#.[`.b.a.(w..^.@]jM.,z..^....&}.n.u...f...G.........n...$..).33...Z.tE=..e...._..,y%.SZ8pe..!.#".Fva"..1:.....5ct...2@6.M....X..T,...u..L<.......D.2{....|..]'..I(.'..4.;....%.?.u...W..;...TT.`.......t.i/L.~v.\.IBv..O<..{.L...uQ..-.}!.........%6D.[..6Z+...a...cE.I6.@..3w.j......}w.)..4...R.7...=M...C.....f..>B../..

                                                                        C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):313166
                                                                        Entropy (8bit):5.841507650976253
                                                                        Encrypted:false
                                                                        SSDEEP:3072:jyMvpjqlLugT1M+eyAIGJ91Dl9q/pa2RE8pxUDtUQZ1FSsMtk0lvSv:jyMlqlBJM+G7/WBaCE8wZUgj+N6
                                                                        MD5:AA2400153641C9E6C0841F0DC8E898CA
                                                                        SHA1:685E7A7AE9A756BDAEA7AAC931E5A43741D0E471
                                                                        SHA-256:3AB7354739E460ADC9C56447706B1F0A0E19BDFD70D9D471C32C771D55D6352B
                                                                        SHA-512:C448BF4B83703FD1193E6681E81AE343BFCD712C2E7300C71B8EA8E885FEB62E86C490199BC382526D35F7DB84657499F412420390EAF904BB499576DF3C6EB9
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ........X.90...]}.S........%2..Y/u.1...x..o.R"..n..9l..UR...oxR..5.SJ..n%.....f.o3/..K..-..........S..H.mr.^..B.U..aE.SK}T.)..#...;.s|..YK1..x.=..C.^...dX....a..C;.8@V<.Yd./kPN.......z..s.z...u0.}5....N...2.......u.7TY.d.]j%..Mp......}....k..S.]z....b..d..}......5..s.1..$=......o!.).....s.../..v.H_z.6..O]..q[.j....f.g.d.I.n.Y..A'0.....,...P...... |..s...N7-A..C...L......nWnEs.yL&..I.j.U..z|*..:......s$...<2.oh}2p..J....V.r.........>...CF.8..|s|B....U.Q.Q..S.=z..%....zP.Sr.}..C5.`..V.3....4xj.]3.T..=EXZ..D.......\.....B.j}}.p..L6..'?.7Y...]5u.b..D9...5...S*..f%..kF...2..8...d.)F.#.mbs.l.G@.:...j.1.I..X...kY.(..N@#b.H..>.....A.R...#.[`.b.a.(w..^.@]jM.,z..^....&}.n.u...f...G.........n...$..).33...Z.tE=..e...._..,y%.SZ8pe..!.#".Fva"..1:.....5ct...2@6.M....X..T,...u..L<.......D.2{....|..]'..I(.'..4.;....%.?.u...W..;...TT.`.......t.i/L.~v.\.IBv..O<..{.L...uQ..-.}!.........%6D.[..6Z+...a...cE.I6.@..3w.j......}w.)..4...R.7...=M...C.....f..>B../..

                                                                        C:\Users\user\Pictures\u07XQVdY6gRTxyN6vOTqCCub.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\Pictures\u0apTRIaaBzfoydgvcDO3D8B.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):5550990
                                                                        Entropy (8bit):7.928491199766059
                                                                        Encrypted:false
                                                                        SSDEEP:98304:7/LCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAHG:3NoYtLaC2eWMuwyy3tPj9AFaG
                                                                        MD5:C26547D25874EEEBFB9F8A7177D83A7B
                                                                        SHA1:B09368108C800B84E82563B95791BE665ECE9D3F
                                                                        SHA-256:D84070C3B244EB6B1EFDCB32AC8998DD451045F54290B50DDC61451C6F892A52
                                                                        SHA-512:CBDE43994A6AC0E45445D296E6C42EC9F0B53C3EFE65919FB42F445A876924860EDF1015B650D684E01DC1463880BF442C3398F93793974B365F39776351A5A9
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP......(`w{...o..N"..w...U.Z....~b...f.S...s.c.."%.MS..C..#R@.T $L.O1p...2....d..{(Q.....r.iX..E..0......].N.'........{.=.ZP...G..H..j;.:...O...Y..p.!rR..w....1Y..H0E.v..o..W..toHt..@.)..R...q....sb./.F[-..Y....4.+. ...*!......5L.....x......."h.UX.......'R@.=....&*...j..m...]=-.\9......p..'.z.....y.;......K...{|..L....OwM...>...}...<..!%p..,.@Z..1.dO..Z..$k.R.qiqm:......V:..V.1.KH.y9[E..4.d-.........X...........H....e...f..{L.".XP.Y.P!*...@/.........7'?.t.F.t.5....@..d.V:8..X.!3.......8?.K...*.+........jF...dB3.s..erj@|JP......G..S.q..}..*cx'.....SB|.d....X....Z.,:P}...r..E"oj..#.pa*...+..........6u5PA-x-.V....n...P|.S..us...t..I...8. .N..RbI..4X..yc...%.VP...~...}.B..W....QU.s.{..94A........W=l.&f..Q..."...........Q......}..~-TQ.b......s.g.:..h9<.v.....~....U...(...v......fg.c&UoE...o.Q.[...Sg...,.\...]i...@I.G.u.f^.Y.*Jg"\...7#.e...M-.Z....._......l.=./.4...l...C.bC..#)..A-...Q6.[..9#...s...,.3..B...Jq..j^}....I.a.g...4c...YH,...

                                                                        C:\Users\user\Pictures\u0apTRIaaBzfoydgvcDO3D8B.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):5550990
                                                                        Entropy (8bit):7.928491199766059
                                                                        Encrypted:false
                                                                        SSDEEP:98304:7/LCDT661LYtLitwTv6ZCweTiMkmynDN0Nyc13aP1ffoP2S2SD9AFAHG:3NoYtLaC2eWMuwyy3tPj9AFaG
                                                                        MD5:C26547D25874EEEBFB9F8A7177D83A7B
                                                                        SHA1:B09368108C800B84E82563B95791BE665ECE9D3F
                                                                        SHA-256:D84070C3B244EB6B1EFDCB32AC8998DD451045F54290B50DDC61451C6F892A52
                                                                        SHA-512:CBDE43994A6AC0E45445D296E6C42EC9F0B53C3EFE65919FB42F445A876924860EDF1015B650D684E01DC1463880BF442C3398F93793974B365F39776351A5A9
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP......(`w{...o..N"..w...U.Z....~b...f.S...s.c.."%.MS..C..#R@.T $L.O1p...2....d..{(Q.....r.iX..E..0......].N.'........{.=.ZP...G..H..j;.:...O...Y..p.!rR..w....1Y..H0E.v..o..W..toHt..@.)..R...q....sb./.F[-..Y....4.+. ...*!......5L.....x......."h.UX.......'R@.=....&*...j..m...]=-.\9......p..'.z.....y.;......K...{|..L....OwM...>...}...<..!%p..,.@Z..1.dO..Z..$k.R.qiqm:......V:..V.1.KH.y9[E..4.d-.........X...........H....e...f..{L.".XP.Y.P!*...@/.........7'?.t.F.t.5....@..d.V:8..X.!3.......8?.K...*.+........jF...dB3.s..erj@|JP......G..S.q..}..*cx'.....SB|.d....X....Z.,:P}...r..E"oj..#.pa*...+..........6u5PA-x-.V....n...P|.S..us...t..I...8. .N..RbI..4X..yc...%.VP...~...}.B..W....QU.s.{..94A........W=l.&f..Q..."...........Q......}..~-TQ.b......s.g.:..h9<.v.....~....U...(...v......fg.c&UoE...o.Q.[...Sg...,.\...]i...@I.G.u.f^.Y.*Jg"\...7#.e...M-.Z....._......l.=./.4...l...C.bC..#)..A-...Q6.[..9#...s...,.3..B...Jq..j^}....I.a.g...4c...YH,...

                                                                        C:\Users\user\Pictures\v5b6ykiuRrf9juwnW3RUfpyP.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):4402048
                                                                        Entropy (8bit):7.940350876533681
                                                                        Encrypted:false
                                                                        SSDEEP:98304:mV6pJpBiXUW91wt7b0jGpNV5tUex4JVcQWi8glX:VpBNW91wVrN36e+uJiPlX
                                                                        MD5:64E22A1C0959444E0D23AE1977FB1075
                                                                        SHA1:48789B8B45F129503E87E9C301D71EA572702DC0
                                                                        SHA-256:A048229B95AF5A93A08B4BD6C36303D58914E4FB5B7A99405FFD6F00C2429C21
                                                                        SHA-512:FEC8AC660DBD0628E1C334DE6A7EAF211D54E98C4526930BD6D8654216CC0B37EA1C7C8B9A9A5002180194FD63374B340CB5541CC19AF747B85BE9C32DCEFD7D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L...djob..................B..........T....... B...@..........................PX.....6.C.......................................B.d....pW.............. C..............................................B..@............................................text.....B.......B................. ..`.data...$L... B..>....B.............@....rsrc........pW......DB.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\wIL2ZlmqVCEy0oDKdGcGn17c.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):651776
                                                                        Entropy (8bit):7.129371779204871
                                                                        Encrypted:false
                                                                        SSDEEP:6144:JfIJs1RHFDIOhkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmAtcH5049Duca049Duc1y6
                                                                        MD5:2D05CB7FB4726BB51C6059540F0E013E
                                                                        SHA1:E7D75AD671C662BA956E54CCFFF28465E851624D
                                                                        SHA-256:8F116AEE53ABCA68CA7BE71A7B5574C84F5DF03D38FC8A524CE4D256AB380AA4
                                                                        SHA-512:890999D65AB16445EB6743AD83802C14D3798DA9485A973B237DC3C419683358E9C2609A3566594E53A60AE207561724C06C533C4D1FA2C42F9F9056E0E8B82B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./d/.k.A.k.A.k.A.b}.j.A.b}.i.A.b}.J.A.k.@.6.A.b}...A.b}...A.b}.j.A.b}.j.A.Richk.A.........................PE..d...m.[J.........."..........*............................................... ......86....@.......... ......................................x...T.......|.......0...................@...........................................h....................................text...(........................... ..`.data...8...........................@....pdata..0...........................@..@.rsrc...............................@..@.reloc..N...........................@..Bk.[J....+.[J......[J....+.[J......[J......[J....+.[J......[J....+.[J......[J......[J....g.[J......[J....f.[J....T.[J'...+.[J....Y.[J3...'.[J?...%.[JJ...N.[JT...........ADVAPI32.dll.ntdll.DLL.KERNEL32.dll.GDI32.dll.USER32.dll.msvcrt.dll.ole32.dll.OLEACC.dll.COMCTL32.dll.OLEAUT32.dll.gdiplus.dll.S

                                                                        C:\Users\user\Pictures\wlmRug0KapvbPX1WnJ7a9tAS.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):5494552
                                                                        Entropy (8bit):7.694508317536258
                                                                        Encrypted:false
                                                                        SSDEEP:98304:BqbZdlRakLa7Czy+JG87IlPEU0KQjvcnyEU:0ZdlRtLa7C2InBU0KQjv8U
                                                                        MD5:7AF78ECFA55E8AEB8B699076266F7BCF
                                                                        SHA1:432C9DEB88D92AE86C55DE81AF26527D7D1AF673
                                                                        SHA-256:F7284ADE2CA0AEB432CF1FDAE5AB0C724F81D10B914F6D4C2C15EF0F60FF316E
                                                                        SHA-512:3C0AE6B6E4A896DA52FAFF4FB2E958ABB2856330CBBA6FF4B7A59E7512475E1739CCCF2CFDA7DDE492F381D3225263BC77E3154983E86933FA074696E92A059E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.....a.S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...8...........................`..`.data...@.R.......R.................@....rdata........S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss..........S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                        C:\Users\user\Pictures\xMv1lQvTXvtVjdQOBRe7tSvZ.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):7
                                                                        Entropy (8bit):2.8073549220576046
                                                                        Encrypted:false
                                                                        SSDEEP:3:YmQB:Y7
                                                                        MD5:24FE48030F7D3097D5882535B04C3FA8
                                                                        SHA1:A689A999A5E62055BDA8C21B1DBE92C119308DEF
                                                                        SHA-256:424A2551D356754C882D04AC16C63E6B50B80B159549D23231001F629455756E
                                                                        SHA-512:45A842447D5E9C10822F7D5DB1192A0E8E7917E6546DAB6AEBE2542B5A82BEDC26AA8D96E3E99DE82E2D0B662FCAC70D6914248371AF034B763F5DD85DAB0C51
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Expired

                                                                        C:\Users\user\Pictures\xWzXbvgqSclHLdENdr90zH0e.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):1534472
                                                                        Entropy (8bit):6.811304624311313
                                                                        Encrypted:false
                                                                        SSDEEP:24576:1D1YS7FpyUxT3DC2O1zj1SqdAGFQZIxmC45UJoeXF9w:wQ5xT3DDWzjYq+ZIgL5UJoek
                                                                        MD5:AA3602359BB93695DA27345D82A95C77
                                                                        SHA1:9CB550458F95D631FEF3A89144FC9283D6C9F75A
                                                                        SHA-256:E9225898FFE63C67058EA7E7EB5E0DC2A9CE286E83624BD85604142A07619E7D
                                                                        SHA-512:ADF43781D3F1FEC56BC9CDCD1D4A8DDF1C4321206B16F70968B6FFCCB59C943AED77C1192BF701CCC1AB2CE0F29B77EB76A33EBA47D129A9248B61476DB78A36
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................?.......................................Y..(.... ..\V..............pS..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...\V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\Pictures\xmJBaRtKA9fm4EreSTrCxLrH.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Pictures\zB0tyM6N8N1lhBO2ZyVBkpB0.exe

                                                                        Download File
                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):763826
                                                                        Entropy (8bit):5.937233273740398
                                                                        Encrypted:false
                                                                        SSDEEP:12288:lQi34eoVo/L6m6URA3PhSxqCrqiryneEjemGAwyXt:lQi7HehhSxeiWeEjtGIXt
                                                                        MD5:A2CC32A235869FF08CE951A7C159D2A3
                                                                        SHA1:FEE7B158DF4C261FD7E6C9153C07CEA2A0C44BDE
                                                                        SHA-256:8DB8E0ACE2BBAD2031E63DB31A3996773C5BA941FFEBC215996D9E419F9710F8
                                                                        SHA-512:B8D04EE6A322127B21FB169B40C52100C8D11FFB9E1D9DA916DE9B8FBE5C64E4C0C9FC419DA2AB69FDB74BE794B9092493C335E5D8C1AD7CD1F0E7F27648E898
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@.......................................@......@..............................P...................................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc...............................@..P.............@......................@..P........................................................................................................................................

                                                                        C:\Users\user\Searches\winrt--{S-1-5-21-3853321935-2125563209-4053062332-1002}-.searchconnector-ms

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1193
                                                                        Entropy (8bit):7.830571352934086
                                                                        Encrypted:false
                                                                        SSDEEP:24:yDU6v7S/R91t8tZP039gJ74WkR9X0Q6j3LF2AWRySLcdyEhkSWbD:ylvzZP0aWrkj3oveyEh+D
                                                                        MD5:897284FE6FFCD0E69E813D43ED796562
                                                                        SHA1:8803BFB40FD4F32AC11FB1FE3082FCF3304EAE2E
                                                                        SHA-256:E5600A894B47D14F302EAD72241E576220E11EEEABDC90590DB8F252B1CDEE2A
                                                                        SHA-512:BA56501308B6FF09CE3DF0D68D5534FFF21C14352D0FEE1DB1F1011D042EFFD11E1139B98D699EB4C0E6C21946D7B052223D7727C0BF240B226F58B8B1BC4110
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<?xml.u...EO.........P.35 .:A~+.....z{.3.....n..'.8....."........\n..7;.%.....B.G. ..~H./....<d....+...s.^..pY..P..@......q..x..@~.........cM;......<.......k.....{.G\..\7"...k..C9.n..Y...}u...E~..UU..D=.;.-.....Z..9..!...1.no...c..G`m.r.|..'L.W..?Y.C2.5.*xQ^...%.b...o...6..'.2..P.W.!,. .m;.j.e..Y...slI..`..RW).'.IC....6.;]...4.pj..|<....9.7M.$.1......T.L..0.....?T....3.....ap...H..5.<.U......r.2.t5t.U..H...+0...-.N.....6. ....!.hX.....I..i......f..-..r#.BW;H.......r2vb.e[...P..^`..J.C..#u%XVNR.+c0:..$...|.`3|.......$.\..0.|..._.|..............7(.=V6...V|.....GP.....f.1.?.&R..U..7.U.......*..m.d.oG....+ .79G+r5..qk....{*..{m.{.......S.......`..,o@.X%....O,..G_.B!.f.hs......Y..3./.\.L..e;.N..]..Nz2,Ju5..P....b.h..J...UT...';..u..N....p./q.'..... ...A..}.(.i&..{..|...&...D.t.X.;4..y.........-.O$..N;Y....".....6T..X&.M._....-.....Y..0..+.^....l...&.M^.?b].....]....YX.k..Iy...o).Fy....D..,.\pffkg).Qc!..QD9d.z.IS....t..F...b...

                                                                        C:\Users\user\Searches\winrt--{S-1-5-21-3853321935-2125563209-4053062332-1002}-.searchconnector-ms.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):1193
                                                                        Entropy (8bit):7.830571352934086
                                                                        Encrypted:false
                                                                        SSDEEP:24:yDU6v7S/R91t8tZP039gJ74WkR9X0Q6j3LF2AWRySLcdyEhkSWbD:ylvzZP0aWrkj3oveyEh+D
                                                                        MD5:897284FE6FFCD0E69E813D43ED796562
                                                                        SHA1:8803BFB40FD4F32AC11FB1FE3082FCF3304EAE2E
                                                                        SHA-256:E5600A894B47D14F302EAD72241E576220E11EEEABDC90590DB8F252B1CDEE2A
                                                                        SHA-512:BA56501308B6FF09CE3DF0D68D5534FFF21C14352D0FEE1DB1F1011D042EFFD11E1139B98D699EB4C0E6C21946D7B052223D7727C0BF240B226F58B8B1BC4110
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:<?xml.u...EO.........P.35 .:A~+.....z{.3.....n..'.8....."........\n..7;.%.....B.G. ..~H./....<d....+...s.^..pY..P..@......q..x..@~.........cM;......<.......k.....{.G\..\7"...k..C9.n..Y...}u...E~..UU..D=.;.-.....Z..9..!...1.no...c..G`m.r.|..'L.W..?Y.C2.5.*xQ^...%.b...o...6..'.2..P.W.!,. .m;.j.e..Y...slI..`..RW).'.IC....6.;]...4.pj..|<....9.7M.$.1......T.L..0.....?T....3.....ap...H..5.<.U......r.2.t5t.U..H...+0...-.N.....6. ....!.hX.....I..i......f..-..r#.BW;H.......r2vb.e[...P..^`..J.C..#u%XVNR.+c0:..$...|.`3|.......$.\..0.|..._.|..............7(.=V6...V|.....GP.....f.1.?.&R..U..7.U.......*..m.d.oG....+ .79G+r5..qk....{*..{m.{.......S.......`..,o@.X%....O,..G_.B!.f.hs......Y..3./.\.L..e;.N..]..Nz2,Ju5..P....b.h..J...UT...';..u..N....p./q.'..... ...A..}.(.i&..{..|...&...D.t.X.;4..y.........-.O$..N;Y....".....6T..X&.M._....-.....Y..0..+.^....l...&.M^.?b].....]....YX.k..Iy...o).Fy....D..,.\pffkg).Qc!..QD9d.z.IS....t..F...b...

                                                                        C:\Users\user\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1025\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):82728
                                                                        Entropy (8bit):7.997649257682935
                                                                        Encrypted:true
                                                                        SSDEEP:1536:GQwXatDb5uCSPu6PY1U3q34h+Btu0ij4wsVO/xfCzIWW3/+cY0jDh3:GPqtDuPzPgU3q3vtuVjJCQUIXK0j5
                                                                        MD5:B7B10332BC04B06582B1D0CB841CBBC6
                                                                        SHA1:F5728CA61C37A22AE61867889461BB35DCFB6F1F
                                                                        SHA-256:BCDE2EE2C16BCDBFAE803AA086DB5D6E30EB5BEA21D2B6B2D374CD22D0559DEB
                                                                        SHA-512:1346CB0C44E5DCF9409D7093DD13A11D2C467C27F4496F5C3DB03C182CF49548328BA576E97CF9B6E4CF8D7BE903DD57C60C59AEEA72CC300790806827F2ADE6
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?Ji./.|y.93...Xr."..|FK.'.."p........m...i..!...h...~..t..b....L..w{.v%^.gmK......G.c.>if..}...>..|.x...."..s;\o...b.cA..t[...A a.d{.u...sj..i.7.9N..........Mv......FA*.!}`z,....~...c..,.../..H..#..P.S......%.....!......_a&..../.Q...h6.?...9\.}.&...%.!l.,r......P.~$..VCW$.Iq..*....T.H..eI9...wh..*..y.....x..&.l8.,....G...n0....^~l].^.v.k{....K.~kH#....*O.<nb.I. B.<.t..X....P..D..%~.7.(.#..|>...&.F:.u+.8.r.sH?.|$q..-\...h..*<.jvP..-*.!....j..5...*;...M_....[i .b.i....!.}..)....`.x.O.j.-.e`.e..OMi..F.k1.J7..u.........V2...H..j....R&.]..."...j%N.g..x=.!...k..m..T..?...b..2O.$..S4.......z...B`.;../.......@..z.}.....s.W..L...Y...=+..Q.a...!fd...3.h0....M..}..C.....1....S.k....v.#.. 3.$..$.4...~...G..:..=.z_.i...].1..F..50B]..~9Ya\..t..~.......53=.u.c6...o.%%.R..4<.{..z} n.v.1A.O.\c....@,.)....H.].RP...N.n{.?.........G...E...$.. ...Rp.i.9..l..5.... ....yj...^.bY.<..#5....}.bM...V-.n..@.=#......i......M.....h.J..!O.+..e5+..Qw....QSr...V%x.}.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1025\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):82728
                                                                        Entropy (8bit):7.997649257682935
                                                                        Encrypted:true
                                                                        SSDEEP:1536:GQwXatDb5uCSPu6PY1U3q34h+Btu0ij4wsVO/xfCzIWW3/+cY0jDh3:GPqtDuPzPgU3q3vtuVjJCQUIXK0j5
                                                                        MD5:B7B10332BC04B06582B1D0CB841CBBC6
                                                                        SHA1:F5728CA61C37A22AE61867889461BB35DCFB6F1F
                                                                        SHA-256:BCDE2EE2C16BCDBFAE803AA086DB5D6E30EB5BEA21D2B6B2D374CD22D0559DEB
                                                                        SHA-512:1346CB0C44E5DCF9409D7093DD13A11D2C467C27F4496F5C3DB03C182CF49548328BA576E97CF9B6E4CF8D7BE903DD57C60C59AEEA72CC300790806827F2ADE6
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?Ji./.|y.93...Xr."..|FK.'.."p........m...i..!...h...~..t..b....L..w{.v%^.gmK......G.c.>if..}...>..|.x...."..s;\o...b.cA..t[...A a.d{.u...sj..i.7.9N..........Mv......FA*.!}`z,....~...c..,.../..H..#..P.S......%.....!......_a&..../.Q...h6.?...9\.}.&...%.!l.,r......P.~$..VCW$.Iq..*....T.H..eI9...wh..*..y.....x..&.l8.,....G...n0....^~l].^.v.k{....K.~kH#....*O.<nb.I. B.<.t..X....P..D..%~.7.(.#..|>...&.F:.u+.8.r.sH?.|$q..-\...h..*<.jvP..-*.!....j..5...*;...M_....[i .b.i....!.}..)....`.x.O.j.-.e`.e..OMi..F.k1.J7..u.........V2...H..j....R&.]..."...j%N.g..x=.!...k..m..T..?...b..2O.$..S4.......z...B`.;../.......@..z.}.....s.W..L...Y...=+..Q.a...!fd...3.h0....M..}..C.....1....S.k....v.#.. 3.$..$.4...~...G..:..=.z_.i...].1..F..50B]..~9Ya\..t..~.......53=.u.c6...o.%%.R..4<.{..z} n.v.1A.O.\c....@,.)....H.].RP...N.n{.?.........G...E...$.. ...Rp.i.9..l..5.... ....yj...^.bY.<..#5....}.bM...V-.n..@.=#......i......M.....h.J..!O.+..e5+..Qw....QSr...V%x.}.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1025\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1025\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version .
                                                                        Category:dropped
                                                                        Size (bytes):13735
                                                                        Entropy (8bit):7.986211143128294
                                                                        Encrypted:false
                                                                        SSDEEP:384:49u0Ef48GYIuwPAS8bu4El2BY8A/ar5can5FrVnPeF:4xtGwZl4ElABlNPeF
                                                                        MD5:ECEC128AFC1F5AABE7C56532D5939CCB
                                                                        SHA1:C0B5F6B697EDF9A3D28ABC8EBB819F488D5175F7
                                                                        SHA-256:2F005CDADA9EF240FA5DC3355AE812A1AE387E70FB33CDBBB2C82F1FC7ADC018
                                                                        SHA-512:180ABBE053D8D2258858DED2C03134908AEB51E2EA2571AF9BACAF137FB5B78CB75329B17E894C83D639D5CE205BFF5138EEDFAE99F5C73F02AACB354CCE3D0A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.V..].4n..A:.")z6......,.N.`.k..%7.1.m._.........r......{S.a.f.]......N.4|..wX.B.,\..}.'.E.".t...I...W....H..`F%.e@r...p.. {.".....R.B.7.....(.k..{W..P:.....3...:..9.0.Z.Q.[...du...Fx?1{..%.{X.#..t.<..B.1.p..ek..#<......7u.!.R.4.2....&...Db}..>&@+ l..u. (Y?...).Ap.+....7.%.......$]$.d<r..e......l....p..2.$.U7..*x...N..2.D..7}.:.._.?.f.../}h.l...".....Y....P..d.#)....(.xwj....-=.7.V.Ot..w+*.>.@...i ./@z>.@...,......$..A..~>5.Y..I.5O._.l.Lu.-.....a\.Zl...:..DrV......s>.oV...p..,).W_.3~..%F..i.|.l.i?...&....T7.*.a~G.*.;..8c!Z.....*~.L.....N[wS.p....p....<..V..C...3x..o&.7E.i.oWC%.M*.`..2.|.NA.8..uS.6a@.....Y2..`..4.......LX".(b4{X.S.N,.qN........H.nYx.e./.U..I.H.1.QR.r].u.^......_.Ll...;#......6P%0..Y...m..g:[.$.H..sv.R.9G...*.eJ.xM../b..t9...V.C..t.p.mUU.....wm.}.F..0....G.Elq>_..o.g...f.......u.I..S.KyL..Y_....sc..6.H:E0.c.;.9.....s8TP8.U...4^....7.)ey .^.(..........c.\..r..lb..\s....%..y.5..@.TUrC...3....w2.I...$.. L.]Z...s2.z....Y...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1025\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version .
                                                                        Category:dropped
                                                                        Size (bytes):13735
                                                                        Entropy (8bit):7.986211143128294
                                                                        Encrypted:false
                                                                        SSDEEP:384:49u0Ef48GYIuwPAS8bu4El2BY8A/ar5can5FrVnPeF:4xtGwZl4ElABlNPeF
                                                                        MD5:ECEC128AFC1F5AABE7C56532D5939CCB
                                                                        SHA1:C0B5F6B697EDF9A3D28ABC8EBB819F488D5175F7
                                                                        SHA-256:2F005CDADA9EF240FA5DC3355AE812A1AE387E70FB33CDBBB2C82F1FC7ADC018
                                                                        SHA-512:180ABBE053D8D2258858DED2C03134908AEB51E2EA2571AF9BACAF137FB5B78CB75329B17E894C83D639D5CE205BFF5138EEDFAE99F5C73F02AACB354CCE3D0A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.V..].4n..A:.")z6......,.N.`.k..%7.1.m._.........r......{S.a.f.]......N.4|..wX.B.,\..}.'.E.".t...I...W....H..`F%.e@r...p.. {.".....R.B.7.....(.k..{W..P:.....3...:..9.0.Z.Q.[...du...Fx?1{..%.{X.#..t.<..B.1.p..ek..#<......7u.!.R.4.2....&...Db}..>&@+ l..u. (Y?...).Ap.+....7.%.......$]$.d<r..e......l....p..2.$.U7..*x...N..2.D..7}.:.._.?.f.../}h.l...".....Y....P..d.#)....(.xwj....-=.7.V.Ot..w+*.>.@...i ./@z>.@...,......$..A..~>5.Y..I.5O._.l.Lu.-.....a\.Zl...:..DrV......s>.oV...p..,).W_.3~..%F..i.|.l.i?...&....T7.*.a~G.*.;..8c!Z.....*~.L.....N[wS.p....p....<..V..C...3x..o&.7E.i.oWC%.M*.`..2.|.NA.8..uS.6a@.....Y2..`..4.......LX".(b4{X.S.N,.qN........H.nYx.e./.U..I.H.1.QR.r].u.^......_.Ll...;#......6P%0..Y...m..g:[.$.H..sv.R.9G...*.eJ.xM../b..t9...V.C..t.p.mUU.....wm.}.F..0....G.Elq>_..o.g...f.......u.I..S.KyL..Y_....sc..6.H:E0.c.;.9.....s8TP8.U...4^....7.)ey .^.(..........c.\..r..lb..\s....%..y.5..@.TUrC...3....w2.I...$.. L.]Z...s2.z....Y...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1028\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):71296
                                                                        Entropy (8bit):7.997231834669989
                                                                        Encrypted:true
                                                                        SSDEEP:1536:mI7fZ4QpYLwKQxPXpkteTIJU9AE3lNKbdb/c9enizky:mUKQucxPZktYIJQ3a4jv
                                                                        MD5:B4EDE38C82E48E8DE42FF3B99C00E7AF
                                                                        SHA1:72E5D6EBF8BA5E7A670225941147D7236BB88080
                                                                        SHA-256:A9E290B7063DE65F3E1A46B94D8792EC58DEF3DFA50DD5265B72A047BD82BC43
                                                                        SHA-512:F193523F1A5A68F7A4D7CDF88DEFAE21A53E111B15EF3DC5C6B1FCFF7061F21EAC3AEBDCFD93B99C535C8012B97BCAB7AD50FDA9D918AC1ECBE6B8942B3440C0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?N.X..O..%>..&..3.XH.U..'.(......F.y..G..(..U... ...Q.SA.%:8.../..<.".....v....e....Jk.....E.........Q]>..@.a".(.w.ZR.g.....:..B......?...v....?..~~.\..T..+.&.=..GM}.......B.x\B....G1...G.....C.1.H..]02.%.H.V.........).sgU*qp.&....>*.ZRp.%...Nl.a..Y..~^.B..20.=..Z.......X..e...5.\..#8..J..Z{(.A...P......7...(+..p1Tp.i....\o....:6.....GJ.9...g.'.@...V|..l?E.|.....e.Bm.<G4..bm...:N.q..$.&$.c......"~...o0...B\$I.O=.x&.<.*. ....-...Y....F0/@...`G{..*...[j.={.y.....^..s(..EV..J5...._..L..{..........N.~49X....I...[qn.>..N..`R....+_..`D.tvd.3..E...y.Z+ +Xg....Y%q...w.N...PL.4.wSN.ar...*4..iY.L.c{.e.Am.)c.HV.......f5.6rb..,.._.E..)..d_H.../.eJa?:.S.....x....Z$......d.hE.3.".....>....zDj;....ik1.0.....2..#..{N.Vw.Rh.......6.c.1....N`X.$...)../}|W/'...&.>W.B.c.Y.......<V..b.......,...+.F..@.S...?....G>........yG...m.X...H.CF..[...Z0..w.L.f..?e.Va..@.......o*{.T..f4..WR..u.#.q#.]..WJ.N......o.k..s.'..u+...<}k-H.<Uf6..E..Gw....X.<....>..\ ;...2aG.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1028\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):71296
                                                                        Entropy (8bit):7.997231834669989
                                                                        Encrypted:true
                                                                        SSDEEP:1536:mI7fZ4QpYLwKQxPXpkteTIJU9AE3lNKbdb/c9enizky:mUKQucxPZktYIJQ3a4jv
                                                                        MD5:B4EDE38C82E48E8DE42FF3B99C00E7AF
                                                                        SHA1:72E5D6EBF8BA5E7A670225941147D7236BB88080
                                                                        SHA-256:A9E290B7063DE65F3E1A46B94D8792EC58DEF3DFA50DD5265B72A047BD82BC43
                                                                        SHA-512:F193523F1A5A68F7A4D7CDF88DEFAE21A53E111B15EF3DC5C6B1FCFF7061F21EAC3AEBDCFD93B99C535C8012B97BCAB7AD50FDA9D918AC1ECBE6B8942B3440C0
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?N.X..O..%>..&..3.XH.U..'.(......F.y..G..(..U... ...Q.SA.%:8.../..<.".....v....e....Jk.....E.........Q]>..@.a".(.w.ZR.g.....:..B......?...v....?..~~.\..T..+.&.=..GM}.......B.x\B....G1...G.....C.1.H..]02.%.H.V.........).sgU*qp.&....>*.ZRp.%...Nl.a..Y..~^.B..20.=..Z.......X..e...5.\..#8..J..Z{(.A...P......7...(+..p1Tp.i....\o....:6.....GJ.9...g.'.@...V|..l?E.|.....e.Bm.<G4..bm...:N.q..$.&$.c......"~...o0...B\$I.O=.x&.<.*. ....-...Y....F0/@...`G{..*...[j.={.y.....^..s(..EV..J5...._..L..{..........N.~49X....I...[qn.>..N..`R....+_..`D.tvd.3..E...y.Z+ +Xg....Y%q...w.N...PL.4.wSN.ar...*4..iY.L.c{.e.Am.)c.HV.......f5.6rb..,.._.E..)..d_H.../.eJa?:.S.....x....Z$......d.hE.3.".....>....zDj;....ik1.0.....2..#..{N.Vw.Rh.......6.c.1....N`X.$...)../}|W/'...&.>W.B.c.Y.......<V..b.......,...+.F..@.S...?....G>........yG...m.X...H.CF..[...Z0..w.L.f..?e.Va..@.......o*{.T..f4..WR..u.#.q#.]..WJ.N......o.k..s.'..u+...<}k-H.<Uf6..E..Gw....X.<....>..\ ;...2aG.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1028\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1028\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version e
                                                                        Category:dropped
                                                                        Size (bytes):12426
                                                                        Entropy (8bit):7.981092441337052
                                                                        Encrypted:false
                                                                        SSDEEP:192:5GPWlF83CG4oy2tmu6TpJtoUUWmcGnPPvLKUwBa969J7sVADQAEd5Qs3Mt2ts:UPWlfG4Ymu2fSPDKUwx9JjtE3QscMts
                                                                        MD5:26F043F78386F011DC1E29B8927A09A5
                                                                        SHA1:9FCE0307D62022352C5E4300CEFAFA6E0E7188CD
                                                                        SHA-256:08AC54787218AFDA0EE083D8C72282B8C49AF0AC8649291EFDE33AB0FB6B1604
                                                                        SHA-512:3E774FE1815265D699B09A71D5CAB54347D73C1EA3B5107FA4F74ECDC0FD33F123F7A9356DC065B3DE07707BB3A7C6E78B836ED468B71DEF42528AA742265D7B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfe.....T.."y....wL.-..uQQWA...7.>bSa.;#.a.E...g%..L..e.9.3w..%.-.2<.st.J.uL.X...E..4X.....z.Y-.....X..V.....}..Cf..?Q....X.i..3jZ.."t7..!7..aHp..6........=a=]...Eu.;&...\-.kb[.(..+H.......].....6:....D.....4.`Xa......4.'..j..OB...j...U.0...2.A..Vf.JOT......iN".vJ7t..S."..N..z..X..&.0I..3...V.)...mN......=\..:.9...).A.."0...&..|...A.j..%u+y.K..IQ.U.....A..qJ.@...9&...m..`.....a.t x..S`..z4|.u4.~.!.a`1n.n.N?lD..Z.J..G.."u....7.J.5i7$..w...:......f..t..I....{.Mz..........C...`5....(}.b.......h.(.../=w?.vF..5..Z.^..ay0.W.{;MN..=...7.-.Y.O.ez.i...s.Gz.h.C.o].....O).0..p..]h.....S.............M...K..d..(.*AF....{.....?.sF}..&..A..:...R...S.......s...../.....X.^&.d..Dd.lE.....Nn..*oL..O.eD+F...38....EJ.d....>s;...6#.>..-|.t.....i..%Ah....2....>BNWv...A......8J@]..'BL..f..a+3.s..g.......M...Yu. .P].SW!7.4..7.<d)..t\..*....:Z..Re.'.^....Y-zj..E..J..7+.l....~.=,.B..=..2..j\+...5.xG3w...Q}....{.D.M).+jL......g.N`...S*..`!_H....a..U...~...,..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1028\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version e
                                                                        Category:dropped
                                                                        Size (bytes):12426
                                                                        Entropy (8bit):7.981092441337052
                                                                        Encrypted:false
                                                                        SSDEEP:192:5GPWlF83CG4oy2tmu6TpJtoUUWmcGnPPvLKUwBa969J7sVADQAEd5Qs3Mt2ts:UPWlfG4Ymu2fSPDKUwx9JjtE3QscMts
                                                                        MD5:26F043F78386F011DC1E29B8927A09A5
                                                                        SHA1:9FCE0307D62022352C5E4300CEFAFA6E0E7188CD
                                                                        SHA-256:08AC54787218AFDA0EE083D8C72282B8C49AF0AC8649291EFDE33AB0FB6B1604
                                                                        SHA-512:3E774FE1815265D699B09A71D5CAB54347D73C1EA3B5107FA4F74ECDC0FD33F123F7A9356DC065B3DE07707BB3A7C6E78B836ED468B71DEF42528AA742265D7B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfe.....T.."y....wL.-..uQQWA...7.>bSa.;#.a.E...g%..L..e.9.3w..%.-.2<.st.J.uL.X...E..4X.....z.Y-.....X..V.....}..Cf..?Q....X.i..3jZ.."t7..!7..aHp..6........=a=]...Eu.;&...\-.kb[.(..+H.......].....6:....D.....4.`Xa......4.'..j..OB...j...U.0...2.A..Vf.JOT......iN".vJ7t..S."..N..z..X..&.0I..3...V.)...mN......=\..:.9...).A.."0...&..|...A.j..%u+y.K..IQ.U.....A..qJ.@...9&...m..`.....a.t x..S`..z4|.u4.~.!.a`1n.n.N?lD..Z.J..G.."u....7.J.5i7$..w...:......f..t..I....{.Mz..........C...`5....(}.b.......h.(.../=w?.vF..5..Z.^..ay0.W.{;MN..=...7.-.Y.O.ez.i...s.Gz.h.C.o].....O).0..p..]h.....S.............M...K..d..(.*AF....{.....?.sF}..&..A..:...R...S.......s...../.....X.^&.d..Dd.lE.....Nn..*oL..O.eD+F...38....EJ.d....>s;...6#.>..-|.t.....i..%Ah....2....>BNWv...A......8J@]..'BL..f..a+3.s..g.......M...Yu. .P].SW!7.4..7.<d)..t\..*....:Z..Re.'.^....Y-zj..E..J..7+.l....~.=,.B..=..2..j\+...5.xG3w...Q}....{.D.M).+jL......g.N`...S*..`!_H....a..U...~...,..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1029\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88360
                                                                        Entropy (8bit):7.99813486448303
                                                                        Encrypted:true
                                                                        SSDEEP:1536:1Pzd0I19wvySAhj8sleK1nb/bM04PkDhcr4P+mygxcXMnySh3F7X2:1eI7wvyuC5BbgODhTPvyMyShI
                                                                        MD5:6BC02637946E6EF30A1818C2D43D67C0
                                                                        SHA1:72E6E4D1B37A8053399BC65D3D6449F2D45C5810
                                                                        SHA-256:1D9C760FDC9D4280151348E78C70EAF520E7E345A111BB7BA99745292B379E3E
                                                                        SHA-512:0296DC7D024C4F7ED0E25977B168A4151ACADDE6F09731C1EEF693A5197FD223AC77290BA5D96E56C53565FB1F098D5B9722DAB6E638C72E02235B2EED740B9A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?;..3.b..h.T.+a...s,....u.g....0......J...r......j.h.7.i..J.>C....,..|...n5>+......n.`.+....f&.......|-.......+....7...<...E......m....`...lr.Z.........R.-...u....+...m.=..(t..hfi.F`.v..s...T.....Y.hD.t.!...k]......z....Ak{..;{Q....4....6.Q.....\....a[.F.r...~c..W..'7E..F......S)......^E....:.z..H.GR%Qz<....H..H......;..qh...'.._!..(..q..`.+.$..LeC....zqU..".p..?*R.d..;i. ...t.k^y...j~N......T..u.}hAap.......5.L..C.."..$[Wb...FW..Gq....-..j...^...M...)H-..`....&.BN..9....g..."..".....$X.5|..F...@......"y...u5wo...v..x.1..6gl..qsi.#2.........?)m.%q....B.G....B..|..%tF..............~.o.Eh..9...J.d...W.2..H....h...5....|3.*...0...,...l_.)...+.]%.5..P=..).vn.e.D._...=fS...'.jx.1.j...Hq........n/.*..p.?.n..m......x....3X.q....ej:Tfa.....}Z.x].bj..).Z.kzon..N.L....L..!S.s....=.)0.3..F...i$\.mK.....6p...k../vu:.@.g..y..G.#......]!.{.o...ljX..4I.H4..0R.x..~...(.B.D.G...f.j.":...j]...~.....O.._..jn*..xQ7m.....6...b.e.eM..'.$.x..p6*w..,.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1029\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88360
                                                                        Entropy (8bit):7.99813486448303
                                                                        Encrypted:true
                                                                        SSDEEP:1536:1Pzd0I19wvySAhj8sleK1nb/bM04PkDhcr4P+mygxcXMnySh3F7X2:1eI7wvyuC5BbgODhTPvyMyShI
                                                                        MD5:6BC02637946E6EF30A1818C2D43D67C0
                                                                        SHA1:72E6E4D1B37A8053399BC65D3D6449F2D45C5810
                                                                        SHA-256:1D9C760FDC9D4280151348E78C70EAF520E7E345A111BB7BA99745292B379E3E
                                                                        SHA-512:0296DC7D024C4F7ED0E25977B168A4151ACADDE6F09731C1EEF693A5197FD223AC77290BA5D96E56C53565FB1F098D5B9722DAB6E638C72E02235B2EED740B9A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?;..3.b..h.T.+a...s,....u.g....0......J...r......j.h.7.i..J.>C....,..|...n5>+......n.`.+....f&.......|-.......+....7...<...E......m....`...lr.Z.........R.-...u....+...m.=..(t..hfi.F`.v..s...T.....Y.hD.t.!...k]......z....Ak{..;{Q....4....6.Q.....\....a[.F.r...~c..W..'7E..F......S)......^E....:.z..H.GR%Qz<....H..H......;..qh...'.._!..(..q..`.+.$..LeC....zqU..".p..?*R.d..;i. ...t.k^y...j~N......T..u.}hAap.......5.L..C.."..$[Wb...FW..Gq....-..j...^...M...)H-..`....&.BN..9....g..."..".....$X.5|..F...@......"y...u5wo...v..x.1..6gl..qsi.#2.........?)m.%q....B.G....B..|..%tF..............~.o.Eh..9...J.d...W.2..H....h...5....|3.*...0...,...l_.)...+.]%.5..P=..).vn.e.D._...=fS...'.jx.1.j...Hq........n/.*..p.?.n..m......x....3X.q....ej:Tfa.....}Z.x].bj..).Z.kzon..N.L....L..!S.s....=.)0.3..F...i$\.mK.....6p...k../vu:.@.g..y..G.#......]!.{.o...ljX..4I.H4..0R.x..~...(.B.D.G...f.j.":...j]...~.....O.._..jn*..xQ7m.....6...b.e.eM..'.$.x..p6*w..,.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1029\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1029\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version %
                                                                        Category:dropped
                                                                        Size (bytes):8264
                                                                        Entropy (8bit):7.973242886846868
                                                                        Encrypted:false
                                                                        SSDEEP:192:RMJyhrKAzeHwMuR++NUA2Qey7xYaTg1H5zDu7Eqr5oxZ7BTT:9hr/++NUA2+lTgH9D/qr5ofB
                                                                        MD5:E483811DDA653D3E241896A9FD8F12B1
                                                                        SHA1:904424625A8A4988A03E2567AE3505AAC4211586
                                                                        SHA-256:8D9E69732FE5EE7C85CEA2FF02ACB6DB6E2D1D9502515D232A99B066E1A2AF99
                                                                        SHA-512:9535D95DA681277E5AF20705127B37A8047AE0CC060A63B36A11DCDE1767B8E3C6365022196F7DD1308C97A00C962F6BCE38787DD16E9CE38C9AD55C4B48ABA7
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf%o.1.jK.A."..l.B..?......ey.d....1..'......X...|.<|e p.......D.j..|..7....4.~.?.....G.Gn.Z....H.K|..4.6].2M"..y....N.c.8.~...pI..]I.<...J.o..b.....2RLy..r..J.[.f.......,.i.c..9..z..,..wm.........W.V...V7{.=f.dc5.7.....7...w...........V.Q......~;....b..l>..] .Oz.E.a.......X..hn.....4..'..W.2V.Y.6..U....<..Vh.8.Xs....dO..`A.....2...X....J.?F.QK,d.D..z...k_9.....<.....:..d.....DQ.P.P.C..Y.:wIc.R.M_9Q{./..:4..A...z.e.=......T...et....v#.......0H.....+.S..I.BR.D.T...C.p4.e.s.&A...x,+....j...%8b.3.}.!.....H.Z<..%....?:.:.l.6..|...:D...-.]"R......G.....{l.S`....>...Y:....P`.W.;.b.yu.*,Z.+).2)&..6....{.N..Mr*.r.d...M..S.<.{.'m.JB(.......O.!.&hD..'.R....d.._/.6....FC.......?....8.I.&3_).P...t.M\gaQtd]].?.&..`..q.@.'....}......j9n1X..^D*u..!...!.J.^.-YO..;4d....R.....u.........i} V....wrX..z.6J.=.B....8.%qJ..X..j..]*b..=......Ki.QHy.U.....9..P...;..F.`..Y!....P..z.].......7....l(..E_.]....f...g.../@...[.S.mIz.........7......:..y.j.K[..N..`.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1029\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version %
                                                                        Category:dropped
                                                                        Size (bytes):8264
                                                                        Entropy (8bit):7.973242886846868
                                                                        Encrypted:false
                                                                        SSDEEP:192:RMJyhrKAzeHwMuR++NUA2Qey7xYaTg1H5zDu7Eqr5oxZ7BTT:9hr/++NUA2+lTgH9D/qr5ofB
                                                                        MD5:E483811DDA653D3E241896A9FD8F12B1
                                                                        SHA1:904424625A8A4988A03E2567AE3505AAC4211586
                                                                        SHA-256:8D9E69732FE5EE7C85CEA2FF02ACB6DB6E2D1D9502515D232A99B066E1A2AF99
                                                                        SHA-512:9535D95DA681277E5AF20705127B37A8047AE0CC060A63B36A11DCDE1767B8E3C6365022196F7DD1308C97A00C962F6BCE38787DD16E9CE38C9AD55C4B48ABA7
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf%o.1.jK.A."..l.B..?......ey.d....1..'......X...|.<|e p.......D.j..|..7....4.~.?.....G.Gn.Z....H.K|..4.6].2M"..y....N.c.8.~...pI..]I.<...J.o..b.....2RLy..r..J.[.f.......,.i.c..9..z..,..wm.........W.V...V7{.=f.dc5.7.....7...w...........V.Q......~;....b..l>..] .Oz.E.a.......X..hn.....4..'..W.2V.Y.6..U....<..Vh.8.Xs....dO..`A.....2...X....J.?F.QK,d.D..z...k_9.....<.....:..d.....DQ.P.P.C..Y.:wIc.R.M_9Q{./..:4..A...z.e.=......T...et....v#.......0H.....+.S..I.BR.D.T...C.p4.e.s.&A...x,+....j...%8b.3.}.!.....H.Z<..%....?:.:.l.6..|...:D...-.]"R......G.....{l.S`....>...Y:....P`.W.;.b.yu.*,Z.+).2)&..6....{.N..Mr*.r.d...M..S.<.{.'m.JB(.......O.!.&hD..'.R....d.._/.6....FC.......?....8.I.&3_).P...t.M\gaQtd]].?.&..`..q.@.'....}......j9n1X..^D*u..!...!.J.^.-YO..;4d....R.....u.........i} V....wrX..z.6J.=.B....8.%qJ..X..j..]*b..=......Ki.QHy.U.....9..P...;..F.`..Y!....P..z.].......7....l(..E_.]....f...g.../@...[.S.mIz.........7......:..y.j.K[..N..`.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1030\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85934
                                                                        Entropy (8bit):7.997382024700765
                                                                        Encrypted:true
                                                                        SSDEEP:1536:PN0GyDNfcloEFVELDGXWN0DhTUhDLKZ5dq90ATTAL+AVniBAI:l0GyDSlWqXDk4afAVdI
                                                                        MD5:3701FDA424B436F5B5FDB94FF4AB66E7
                                                                        SHA1:C7F6FF1CA1D9ACF37C044A40891E1108BE73CD84
                                                                        SHA-256:275FCC4AD44AA8860224AB94DB665EB9959D1F337CC21A90B4139CC576BA918C
                                                                        SHA-512:611E31B4F203EAD0A98490B7807F8CEFD36300F1DA30E6AD2DC6A94C0B1E7AB09685864075AB335ED574FB515B1B1753FB240334FEA9F63C739EF34FB5EE08D1
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.d.@..q.hl5.#..1h...8Z*.........-.4.....1V...c|..b.-.....P.!..]Ab.u.(T.........g.V..N...y..D....+..m!..W...C?..#......[.....7..7.O.\.G^O.e..v|.5t..p.<..2VJ...{....K.`..D6.ANJ+....s..S9S.8O._....0.-.7.....,@b..:V.......}J.N.\..Po..m.g^....K.........h..V....".W>{m...Q#m..2.^2...+...6..Sd..Jq...'1HA.W?r....U.^.$.|....;)pA...C.>.w.,H...o%K..g..f..e..3q.(...h.;f.`..D....Xy..'.l....a&.1P...`......`..."f.R.<..kb..!..........|...eb8WW..3.....r.....d.8..4...|..j]...3.O#..e......J.r..7b$.b..D....j...y.^$.{..uW.u.R.8..)X..y.jeQ.Q.d.............n........pT.k.|L&3.2.-uhk-..{F.d.YJq;R.....$.............k&.E.SD/...5PnQ....iY..+......$s+.L....g.;oF"r[3.....x...X\..z.x...EX.....Y.s....IJ....O..6.....Y....N.....L.A,..M....a#..TF.L..-S>...PlF..s..M..1t9.....V...y...`U...s..{Y.n...7...&W.....:...)#.!....`..m.x....$...6.....V.............>.....aI.o...n...7......z.^.....^.p..ae..j.+...%D.5C.}ZG. .UVS..n.b.G..A.$.H}.X.....H.>S.8...NV.I.e.^..&.oTgRD....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1030\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85934
                                                                        Entropy (8bit):7.997382024700765
                                                                        Encrypted:true
                                                                        SSDEEP:1536:PN0GyDNfcloEFVELDGXWN0DhTUhDLKZ5dq90ATTAL+AVniBAI:l0GyDSlWqXDk4afAVdI
                                                                        MD5:3701FDA424B436F5B5FDB94FF4AB66E7
                                                                        SHA1:C7F6FF1CA1D9ACF37C044A40891E1108BE73CD84
                                                                        SHA-256:275FCC4AD44AA8860224AB94DB665EB9959D1F337CC21A90B4139CC576BA918C
                                                                        SHA-512:611E31B4F203EAD0A98490B7807F8CEFD36300F1DA30E6AD2DC6A94C0B1E7AB09685864075AB335ED574FB515B1B1753FB240334FEA9F63C739EF34FB5EE08D1
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.d.@..q.hl5.#..1h...8Z*.........-.4.....1V...c|..b.-.....P.!..]Ab.u.(T.........g.V..N...y..D....+..m!..W...C?..#......[.....7..7.O.\.G^O.e..v|.5t..p.<..2VJ...{....K.`..D6.ANJ+....s..S9S.8O._....0.-.7.....,@b..:V.......}J.N.\..Po..m.g^....K.........h..V....".W>{m...Q#m..2.^2...+...6..Sd..Jq...'1HA.W?r....U.^.$.|....;)pA...C.>.w.,H...o%K..g..f..e..3q.(...h.;f.`..D....Xy..'.l....a&.1P...`......`..."f.R.<..kb..!..........|...eb8WW..3.....r.....d.8..4...|..j]...3.O#..e......J.r..7b$.b..D....j...y.^$.{..uW.u.R.8..)X..y.jeQ.Q.d.............n........pT.k.|L&3.2.-uhk-..{F.d.YJq;R.....$.............k&.E.SD/...5PnQ....iY..+......$s+.L....g.;oF"r[3.....x...X\..z.x...EX.....Y.s....IJ....O..6.....Y....N.....L.A,..M....a#..TF.L..-S>...PlF..s..M..1t9.....V...y...`U...s..{Y.n...7...&W.....:...)#.!....`..m.x....$...6.....V.............>.....aI.o...n...7......z.^.....^.p..ae..j.+...%D.5C.}ZG. .UVS..n.b.G..A.$.H}.X.....H.>S.8...NV.I.e.^..&.oTgRD....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1030\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1030\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \263
                                                                        Category:dropped
                                                                        Size (bytes):6148
                                                                        Entropy (8bit):7.9707781026949185
                                                                        Encrypted:false
                                                                        SSDEEP:192:agmNF4B6d7uPipcwLCUh4+7Kqu99JWvU8R:An4w7urxUh4827JWcG
                                                                        MD5:3CB219E19662EE2D487567AE6E6BE881
                                                                        SHA1:0B3B13C90AEAF3F25A6358AE94618B8708D156E2
                                                                        SHA-256:62CEA45FD9315250CB37E0FB519FD2DF23A3A4F52B856D729518ED91F4AE63E7
                                                                        SHA-512:E99E2036B3414BEC961E39E8B8FDD8FD0E024ED23E5D4B8FF37B3B662A947CA0CAD7DAE2490FF8BB8C68731989CCA73477DE5BF29FF5083AB5058A4168E5041D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf..R8..?=].D$|ks.j...8G..x...ni3.....a..P... {O....`.pI.J>.^.bQ.PUd..x}<.I..t7...<..R......Nl.a.. .B.S2.....#......cFr.@...a...y.......7..-62....O.<LQ.....$..R.....v.!.......3p^.....~.C..di._.F.x....]....*g|..i4......y..4.a..L.PMM$1.o.i.$Q=..Fu<srIF...L.M&.A&6.....1.W..(_:..H......#.M..!|@.K..a..]...>....O....=vG...!S0..>...^p8.Y.Rj.f.W.......|...)U.[..........G..'......E5E.S..rc.O....Q-%s.....t.....%...:&.m........?...8.* @{..........??.....hg.~.. .|[V.y.X.Y}F..o.F!@.=.KU.%.~.q..ZAcdn..yWh../s.Y.....p5.D'..2.t...W...w...8..9.h4.R.`q..".`.....-.e.6^*7.jR...\H.....h.F..Ay....xjj/.t.!<..+.T.04.Q.R,u.Zo...e.&.x8Y4.}..v..c?./.R.!.dW.J..Y.!....h...?.es......u.D.N..F+..x..~O..!l}..a....A..R....I.S...U#.[...L.4..=,"r.....*.c.....R.._ .t..t.E...}..J.I...H.u..9.F.`.Lb......y."........./..5......&....IX....g.......~..#.*....{V..$kQ......8.W.o2q.5.X....,KWr.{a..WiHn.j....g.......q....._zkm1.<.}......m.;N.....?C.m..f.&~.<.lo..~uWh.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1030\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \263
                                                                        Category:dropped
                                                                        Size (bytes):6148
                                                                        Entropy (8bit):7.9707781026949185
                                                                        Encrypted:false
                                                                        SSDEEP:192:agmNF4B6d7uPipcwLCUh4+7Kqu99JWvU8R:An4w7urxUh4827JWcG
                                                                        MD5:3CB219E19662EE2D487567AE6E6BE881
                                                                        SHA1:0B3B13C90AEAF3F25A6358AE94618B8708D156E2
                                                                        SHA-256:62CEA45FD9315250CB37E0FB519FD2DF23A3A4F52B856D729518ED91F4AE63E7
                                                                        SHA-512:E99E2036B3414BEC961E39E8B8FDD8FD0E024ED23E5D4B8FF37B3B662A947CA0CAD7DAE2490FF8BB8C68731989CCA73477DE5BF29FF5083AB5058A4168E5041D
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf..R8..?=].D$|ks.j...8G..x...ni3.....a..P... {O....`.pI.J>.^.bQ.PUd..x}<.I..t7...<..R......Nl.a.. .B.S2.....#......cFr.@...a...y.......7..-62....O.<LQ.....$..R.....v.!.......3p^.....~.C..di._.F.x....]....*g|..i4......y..4.a..L.PMM$1.o.i.$Q=..Fu<srIF...L.M&.A&6.....1.W..(_:..H......#.M..!|@.K..a..]...>....O....=vG...!S0..>...^p8.Y.Rj.f.W.......|...)U.[..........G..'......E5E.S..rc.O....Q-%s.....t.....%...:&.m........?...8.* @{..........??.....hg.~.. .|[V.y.X.Y}F..o.F!@.=.KU.%.~.q..ZAcdn..yWh../s.Y.....p5.D'..2.t...W...w...8..9.h4.R.`q..".`.....-.e.6^*7.jR...\H.....h.F..Ay....xjj/.t.!<..+.T.04.Q.R,u.Zo...e.&.x8Y4.}..v..c?./.R.!.dW.J..Y.!....h...?.es......u.D.N..F+..x..~O..!l}..a....A..R....I.S...U#.[...L.4..=,"r.....*.c.....R.._ .t..t.E...}..J.I...H.u..9.F.`.Lb......y."........./..5......&....IX....g.......~..#.*....{V..$kQ......8.W.o2q.5.X....,KWr.{a..WiHn.j....g.......q....._zkm1.<.}......m.;N.....?C.m..f.&~.<.lo..~uWh.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1031\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):90676
                                                                        Entropy (8bit):7.997962321626305
                                                                        Encrypted:true
                                                                        SSDEEP:1536:A/9bAa2wJuFZlewUYVTLSlBia06GLNnwtsfk2W5v2+SOcInGdAmU9YsZtjl:LfwJulUY5L8OXLs2WsUQsjl
                                                                        MD5:D56CF5C42BD1A0DB0E1B03C0D3F41334
                                                                        SHA1:879302C4A9C225AB5B0E1766CAAF8DAA5F508FA9
                                                                        SHA-256:65A112FAA389CF7E8034E6F3F294ACFCAE2B95B1683FF3F98FFA5699D5856011
                                                                        SHA-512:4F75AA85D109F596555235410D275CB898557AC63985595E84C433791CA07EE10B62F0BA94EB0E22ADA3DC354537548F7C82B194D2DED69870CFB385D53A0F07
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..._7......}o..~...C .........Y*h.W....[)...?....bJ..1~....#.R.......m]...tjkQK...y.j.Na..r5..R..z....}.a....f......5.x.a....j..4..k..]e..Ow5.~...'S..L..A/...~.......e.;..P3d?.M&C.*\.Q......Ii...b...@......j%...K.......z......fJ. -.5.8N..v....q.R.1g.x..@F..6..%.-..k...d.. ...x..b(..y....u...b./[{...&..[......N.....C.$5!B.[..1.B...oF....*....P.O.e...........>..+..<..O...BQv(z.....H.`8?..kD`/.op.[.._.h,e..UM.:..A..W.\.Z{./...]..._..`7..R.......S...mNE*l6.........<...L....v.8.9#{..$^~g.I..n(...H..tR.N...BF.#.n.e.HQ.6....%u.$Q.:w.,..{. .!.t.0..M...F.....~.(@..V..'\.$..^za2O.@-.Q.....3.....o.....y..}}4.....v.u.b..!...J.s......./....y..FP..lZ.....7{.....Z..:1..w.........d......)..L.>.....0a..Y._8....)'hE.E..\(.....uq..gD"..NQ.P...(.........:>..v..;.Y|.e.8LS.......`z.v.......d..K .>.9..].G...`dRM....,~3....d.io3.N9.0...FlGW=...P0.[.2..~.....:.BLC.=.....=G.{..x.......g.~..^\....5.........#......HmI1&8rH.6...FBA.@.`...4..?..._lo_[...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1031\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):90676
                                                                        Entropy (8bit):7.997962321626305
                                                                        Encrypted:true
                                                                        SSDEEP:1536:A/9bAa2wJuFZlewUYVTLSlBia06GLNnwtsfk2W5v2+SOcInGdAmU9YsZtjl:LfwJulUY5L8OXLs2WsUQsjl
                                                                        MD5:D56CF5C42BD1A0DB0E1B03C0D3F41334
                                                                        SHA1:879302C4A9C225AB5B0E1766CAAF8DAA5F508FA9
                                                                        SHA-256:65A112FAA389CF7E8034E6F3F294ACFCAE2B95B1683FF3F98FFA5699D5856011
                                                                        SHA-512:4F75AA85D109F596555235410D275CB898557AC63985595E84C433791CA07EE10B62F0BA94EB0E22ADA3DC354537548F7C82B194D2DED69870CFB385D53A0F07
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..._7......}o..~...C .........Y*h.W....[)...?....bJ..1~....#.R.......m]...tjkQK...y.j.Na..r5..R..z....}.a....f......5.x.a....j..4..k..]e..Ow5.~...'S..L..A/...~.......e.;..P3d?.M&C.*\.Q......Ii...b...@......j%...K.......z......fJ. -.5.8N..v....q.R.1g.x..@F..6..%.-..k...d.. ...x..b(..y....u...b./[{...&..[......N.....C.$5!B.[..1.B...oF....*....P.O.e...........>..+..<..O...BQv(z.....H.`8?..kD`/.op.[.._.h,e..UM.:..A..W.\.Z{./...]..._..`7..R.......S...mNE*l6.........<...L....v.8.9#{..$^~g.I..n(...H..tR.N...BF.#.n.e.HQ.6....%u.$Q.:w.,..{. .!.t.0..M...F.....~.(@..V..'\.$..^za2O.@-.Q.....3.....o.....y..}}4.....v.u.b..!...J.s......./....y..FP..lZ.....7{.....Z..:1..w.........d......)..L.>.....0a..Y._8....)'hE.E..\(.....uq..gD"..NQ.P...(.........:>..v..;.Y|.e.8LS.......`z.v.......d..K .>.9..].G...`dRM....,~3....d.io3.N9.0...FlGW=...P0.[.2..~.....:.BLC.=.....=G.{..x.......g.~..^\....5.........#......HmI1&8rH.6...FBA.@.`...4..?..._lo_[...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1031\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1031\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \013
                                                                        Category:dropped
                                                                        Size (bytes):6680
                                                                        Entropy (8bit):7.971733416072302
                                                                        Encrypted:false
                                                                        SSDEEP:192:L2y9aUoSnSl904S5ddVKv+jCJr1Zmny9z:Ky9aDSSE4SvrjCJ
                                                                        MD5:088A315D1234D3D2106E788A53C5318C
                                                                        SHA1:28072AC6F1C8E499F01F9BE3DF28435EA5CA3329
                                                                        SHA-256:5032495A04BB4FC39D6A99BD2B267255C8F000268C605F66ABD5A9E0531BE004
                                                                        SHA-512:7348B37D455A1AAA001DD55176E74DE86ED74AD803E78C71CDEFA132FFEA22C4080A3D794061B35032BF77F88F855EBCF72FFA8447D50BED747D8BC37C806774
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.....k..Q.4..<$./).:i..:1..b.~....8..S....5+..V..T?..Cl..8.D..j:|g.r....*..;gm.1d..B4T..).!..E.ZeJ..V%R$..,...]...._X-..).v:..ut"..n.........u...._....m.`..o..t...Pl`....!T......&..J.6.-.kv..?)b.3.Ca@b.]]E..`.........6...).lQ..dnm........^[5T.x...'..h.}..{..$'......B.U".'....t.+.E.].4[Iw.(..@..<..&.....1.6.G....;....^.......Z$../KkH.[N^_..\......J....J+.....bw...+r~...0M.{m.....;ir.2...Kr.?,.<n?.......".|:....f.v.|.....f;......;)~.....X.i.i.q~.gc.Ww'.....n.w..'@j..t.n0v.....@.$...v..N....X;O.H,.~.v.?#........K......!G..r....F...=:8-.D}..zL.j..7......*..rcE....+..i.Vr...GC;.....x.......l.dX...ru>..N...KK...%u.+.....D......M.;^.........|g...~.3[.1......N......j.S....xb-.U.....)t.<.nV."pI`Y...r......6...H...$MH.Bj.-s/..n...mb.r..g,..8 .K'..M..s.....]..>.W...g7.%.p.....H~..1.vu.z.{W.^..).-.kE.C4%........./.B..\....^z.2.<....o.....V.....1G..l.0!7r.p.#I../..N..-.a1BN.*...u.....ZH...U.5_ME3..2..u.,...>....94.$x...n...L.<3.S.2#$.v

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1031\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \013
                                                                        Category:dropped
                                                                        Size (bytes):6680
                                                                        Entropy (8bit):7.971733416072302
                                                                        Encrypted:false
                                                                        SSDEEP:192:L2y9aUoSnSl904S5ddVKv+jCJr1Zmny9z:Ky9aDSSE4SvrjCJ
                                                                        MD5:088A315D1234D3D2106E788A53C5318C
                                                                        SHA1:28072AC6F1C8E499F01F9BE3DF28435EA5CA3329
                                                                        SHA-256:5032495A04BB4FC39D6A99BD2B267255C8F000268C605F66ABD5A9E0531BE004
                                                                        SHA-512:7348B37D455A1AAA001DD55176E74DE86ED74AD803E78C71CDEFA132FFEA22C4080A3D794061B35032BF77F88F855EBCF72FFA8447D50BED747D8BC37C806774
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.....k..Q.4..<$./).:i..:1..b.~....8..S....5+..V..T?..Cl..8.D..j:|g.r....*..;gm.1d..B4T..).!..E.ZeJ..V%R$..,...]...._X-..).v:..ut"..n.........u...._....m.`..o..t...Pl`....!T......&..J.6.-.kv..?)b.3.Ca@b.]]E..`.........6...).lQ..dnm........^[5T.x...'..h.}..{..$'......B.U".'....t.+.E.].4[Iw.(..@..<..&.....1.6.G....;....^.......Z$../KkH.[N^_..\......J....J+.....bw...+r~...0M.{m.....;ir.2...Kr.?,.<n?.......".|:....f.v.|.....f;......;)~.....X.i.i.q~.gc.Ww'.....n.w..'@j..t.n0v.....@.$...v..N....X;O.H,.~.v.?#........K......!G..r....F...=:8-.D}..zL.j..7......*..rcE....+..i.Vr...GC;.....x.......l.dX...ru>..N...KK...%u.+.....D......M.;^.........|g...~.3[.1......N......j.S....xb-.U.....)t.<.nV."pI`Y...r......6...H...$MH.Bj.-s/..n...mb.r..g,..8 .K'..M..s.....]..>.W...g7.%.p.....H~..1.vu.z.{W.^..).-.kE.C4%........./.B..\....^z.2.<....o.....V.....1G..l.0!7r.p.#I../..N..-.a1BN.*...u.....ZH...U.5_ME3..2..u.,...>....94.$x...n...L.<3.S.2#$.v

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1032\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):92866
                                                                        Entropy (8bit):7.997853011370945
                                                                        Encrypted:true
                                                                        SSDEEP:1536:2HtGznf5ya1/yBgcgQa9sLnpAeZdhqKirV7Oc7adJ+sTeS3q:2HUNya4BoQ/ddYjDv
                                                                        MD5:A008742E86AECA1DF3416EF21E8C1D5A
                                                                        SHA1:8884BFCD6278704066469C0740EA41B365F01EAB
                                                                        SHA-256:700683555E0F49B506D79ECC9F69188D54A182437B3CD22E73816178698D079D
                                                                        SHA-512:7104B143739AC745E0DB0F6CF2E56D2ADF485D3AFE8539E9B81AEE7558CDE0EFE2BB3C87A063ACD3900F3C6622EF29A4AFD17F5DD048129D2317F87338B52A68
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...X....$SJ.l.U..+......;^.4.....*#..%X?........?....9....).S.....-k....0.FXX.+...~..............i.4....+....'ys..x\..=.....:.WW.zt..)3...=S.&....[x..Q.8..`H.@..u.~...>..z.5`.....1.w.>.|..u.^pG..]..^).|..z.2...M......G.OD3.....\...SI..[l..C-81^W...Wg&.6....q..z.......7.E......7..b..U..\..P^7.0U$.1..)..6..].......w....>. .%*.y..9.p...9..R).C.g........ED../....U.pd.cnF.....j.....h...&X..Z./H#....;G8.&..C.J.Z.d..[..5r$.dT.y........V.J..gs........{8....]wR....../..U. !TCJ.Q..R...9.....hJ..3|j...NT...,{y.D......(u..-...v.........$..`.F.#.Yv....%1.F.@.%....d.......1.p?q.E..@.>yLD.'..._..a...a........`.......3.Gt.{..J. .M.|.0...*...1.{.....\.Ly=|.p.WS}a...E....=bI...hJc....:...._....\...... ..[......)..(.>P~.|^.....u.#..&[U......(.3{.S+4...}...\Idz./.4......i......>].#.;.5a....F0.\d.=(E(..6...{..RM[s.....-BJ&S~..)%....j..Q...g....:t.w..k.J.-A.D...x..2..T....<.M.c..i...SMzQ .9.a6.?...B$.g..$p.Q.IU....'...7._rH.i.].A...m..O.:.....q....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1032\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):92866
                                                                        Entropy (8bit):7.997853011370945
                                                                        Encrypted:true
                                                                        SSDEEP:1536:2HtGznf5ya1/yBgcgQa9sLnpAeZdhqKirV7Oc7adJ+sTeS3q:2HUNya4BoQ/ddYjDv
                                                                        MD5:A008742E86AECA1DF3416EF21E8C1D5A
                                                                        SHA1:8884BFCD6278704066469C0740EA41B365F01EAB
                                                                        SHA-256:700683555E0F49B506D79ECC9F69188D54A182437B3CD22E73816178698D079D
                                                                        SHA-512:7104B143739AC745E0DB0F6CF2E56D2ADF485D3AFE8539E9B81AEE7558CDE0EFE2BB3C87A063ACD3900F3C6622EF29A4AFD17F5DD048129D2317F87338B52A68
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...X....$SJ.l.U..+......;^.4.....*#..%X?........?....9....).S.....-k....0.FXX.+...~..............i.4....+....'ys..x\..=.....:.WW.zt..)3...=S.&....[x..Q.8..`H.@..u.~...>..z.5`.....1.w.>.|..u.^pG..]..^).|..z.2...M......G.OD3.....\...SI..[l..C-81^W...Wg&.6....q..z.......7.E......7..b..U..\..P^7.0U$.1..)..6..].......w....>. .%*.y..9.p...9..R).C.g........ED../....U.pd.cnF.....j.....h...&X..Z./H#....;G8.&..C.J.Z.d..[..5r$.dT.y........V.J..gs........{8....]wR....../..U. !TCJ.Q..R...9.....hJ..3|j...NT...,{y.D......(u..-...v.........$..`.F.#.Yv....%1.F.@.%....d.......1.p?q.E..@.>yLD.'..._..a...a........`.......3.Gt.{..J. .M.|.0...*...1.{.....\.Ly=|.p.WS}a...E....=bI...hJc....:...._....\...... ..[......)..(.>P~.|^.....u.#..&[U......(.3{.S+4...}...\Idz./.4......i......>].#.;.5a....F0.\d.=(E(..6...{..RM[s.....-BJ&S~..)%....j..Q...g....:t.w..k.J.-A.D...x..2..T....<.M.c..i...SMzQ .9.a6.?...B$.g..$p.Q.IU....'...7._rH.i.].A...m..O.:.....q....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1032\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1032\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \021
                                                                        Category:dropped
                                                                        Size (bytes):17115
                                                                        Entropy (8bit):7.988929579938681
                                                                        Encrypted:false
                                                                        SSDEEP:384:cADE5X92Kik53afwlNxIZeuIsM2TJi5OyUt6X4vlH:3kZivfwlNxI1IsM229g6GlH
                                                                        MD5:7CBC6F5DCAFE1F937143FEF80B3D74FE
                                                                        SHA1:8B7E0339D8A2587C3E7956F55A06E524A6D69A67
                                                                        SHA-256:02F798354534FBDDE044D80BF46E85398B5AFB2D415D6F4A4941B173D1E79396
                                                                        SHA-512:6B36F26B18A9946637C447CF8F6507F12F3642C714BA5A2C55A53A11C9EE1487EC42C29B22FC377FE4A3F13953663C8290B68168794431C0EE7DD16DFD6BFB6A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.._J."}....0{..Z...&.a&GO. .^.k^.].C...X9.Ml.......5...b.&....!...n ..O.b..w?..&..!a.:*....x.L...Ua.Q&]..?xXyHr.HWn.......@.L....H..o0..7...&.........c..nf...@..... .9.V.E..$.[..}+...z5]........l.....q..(YAL.P...B.8...<.*...8q.J.D.c$..W"x..w..!zw...b......va.^k|4.)T.q...T.f...I,...."..V..W.oe4.2.'{.`.......T.Y.gn....HW[!9*C...l.9C=......L`'....R.t,.9F.......W..............C.....[.q.H+.2.p....I..jJ.".........Df..C.......S....{.....#......'.+...K.=........;f..}....`#.7..O.M.K..u5..sM.7[.X...&>....8.:...*^.Pi.H.T..v.:.;....!(3.......z..........*......@#.R......u.&L.l.'.....s[...O.T.^}..........H..L.O........{6.h.......@.....T.d...].....T..8.2....._uf..T.....'.oe.<zM.d...v..7...c(...CQ..0.Kkg..,..w.1e.........i...}\l..q....FYH...T.r..S......:....c,.zE.c.T.RFi.\2....IQS..R9SDH2...|2%.O.$.....c...8..#.W.Sg8.VY#0[@.....J2...A*-.M.Q.......7.mPO..,.C.th....s.....:...}qZ.x..`.R..f8.r.!...]k...R.CQ*N.I.........P*..'X...).).j.`Ml.'Y..E

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1032\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \021
                                                                        Category:dropped
                                                                        Size (bytes):17115
                                                                        Entropy (8bit):7.988929579938681
                                                                        Encrypted:false
                                                                        SSDEEP:384:cADE5X92Kik53afwlNxIZeuIsM2TJi5OyUt6X4vlH:3kZivfwlNxI1IsM229g6GlH
                                                                        MD5:7CBC6F5DCAFE1F937143FEF80B3D74FE
                                                                        SHA1:8B7E0339D8A2587C3E7956F55A06E524A6D69A67
                                                                        SHA-256:02F798354534FBDDE044D80BF46E85398B5AFB2D415D6F4A4941B173D1E79396
                                                                        SHA-512:6B36F26B18A9946637C447CF8F6507F12F3642C714BA5A2C55A53A11C9EE1487EC42C29B22FC377FE4A3F13953663C8290B68168794431C0EE7DD16DFD6BFB6A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.._J."}....0{..Z...&.a&GO. .^.k^.].C...X9.Ml.......5...b.&....!...n ..O.b..w?..&..!a.:*....x.L...Ua.Q&]..?xXyHr.HWn.......@.L....H..o0..7...&.........c..nf...@..... .9.V.E..$.[..}+...z5]........l.....q..(YAL.P...B.8...<.*...8q.J.D.c$..W"x..w..!zw...b......va.^k|4.)T.q...T.f...I,...."..V..W.oe4.2.'{.`.......T.Y.gn....HW[!9*C...l.9C=......L`'....R.t,.9F.......W..............C.....[.q.H+.2.p....I..jJ.".........Df..C.......S....{.....#......'.+...K.=........;f..}....`#.7..O.M.K..u5..sM.7[.X...&>....8.:...*^.Pi.H.T..v.:.;....!(3.......z..........*......@#.R......u.&L.l.'.....s[...O.T.^}..........H..L.O........{6.h.......@.....T.d...].....T..8.2....._uf..T.....'.oe.<zM.d...v..7...c(...CQ..0.Kkg..,..w.1e.........i...}\l..q....FYH...T.r..S......:....c,.zE.c.T.RFi.\2....IQS..R9SDH2...|2%.O.$.....c...8..#.W.Sg8.VY#0[@.....J2...A*-.M.Q.......7.mPO..,.C.th....s.....:...}qZ.x..`.R..f8.r.!...]k...R.CQ*N.I.........P*..'X...).).j.`Ml.'Y..E

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1033\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85514
                                                                        Entropy (8bit):7.997730031684793
                                                                        Encrypted:true
                                                                        SSDEEP:1536:F4NWn2mixorcP7iqo4K16iNBNVQ7Sdfddc1Cs9VsEnKLzzPq3YlIAstR:FMWnIaLdXNBNIUc19XsEnMhSb
                                                                        MD5:EE6B0E510726CAE59DF342E75932B582
                                                                        SHA1:E35FDBD914D492C01196CA93F8B0C8750B778093
                                                                        SHA-256:46508E43071D99C720CC1803B2270A37BF456AC5129A4DDD88FF1EC35988F44C
                                                                        SHA-512:C0379B505D212C8BD592904E34F0C7AD13CEBD2612271614426D6B2E5BAFC2633A5D66F707E103AC9E664438FE7B69EF08993CD90C4D44FE626C2B31984D7EE6
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..2.A.k...b.....#.........@. .0.B.J.23*\.Obr.... w.l9.P.>. .i...W.bl..}...D.O(....<.E.q..:.ou.u.!..............z..6......_1.)w.r6R@wp...5...=....3..+....r....Cj....9:...g.~n..Y..7Q\v.J.../Q.....Y....i.C.......&.o7h.=nX._..AdZ..~?.$.k. .w+1.......%.C...P..e...gR......2|...yS..q..D5.,.D" .tp......7../.@.I.S'._..?\....H..F.....d....p......\0Avp.(..wN.Zv..B.4.C[...%.l..'3...F......... ....e..g.i...h9.....ub\I..P}.D...;%;......|;....%...d........>0rP.4*&[.~....d.S..ky..V.......J%.'.'!..[..z..K.D.C?.9..`.$S...?U..~.}....\....?.^..#..\!...L...X...B{.../[[`.^.n..+x...%.;+...^..=.B!.o...y.U.[8..u..6.0.Su.Uu'8>...D.gf......^7bPhV.}..F....4d1#..].._...5..e..Dc....+G3f.$t..d*.t.j...)3...9..!.-..I0.uU.u...T..T.p..^...)...,...i...e.e}..Wi.......g(.'a.ws..d'.P..%....d.P...8$|............o.].Zi..........(o.d..; `.0...X....7.H...)R..1..\......8.aF..DN.0$...V...!./.;.P..p..u..E..o~...m...-.d.u.#.....O7.i... s)...N...v.e..YW....)V...w....|..2g.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1033\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85514
                                                                        Entropy (8bit):7.997730031684793
                                                                        Encrypted:true
                                                                        SSDEEP:1536:F4NWn2mixorcP7iqo4K16iNBNVQ7Sdfddc1Cs9VsEnKLzzPq3YlIAstR:FMWnIaLdXNBNIUc19XsEnMhSb
                                                                        MD5:EE6B0E510726CAE59DF342E75932B582
                                                                        SHA1:E35FDBD914D492C01196CA93F8B0C8750B778093
                                                                        SHA-256:46508E43071D99C720CC1803B2270A37BF456AC5129A4DDD88FF1EC35988F44C
                                                                        SHA-512:C0379B505D212C8BD592904E34F0C7AD13CEBD2612271614426D6B2E5BAFC2633A5D66F707E103AC9E664438FE7B69EF08993CD90C4D44FE626C2B31984D7EE6
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..2.A.k...b.....#.........@. .0.B.J.23*\.Obr.... w.l9.P.>. .i...W.bl..}...D.O(....<.E.q..:.ou.u.!..............z..6......_1.)w.r6R@wp...5...=....3..+....r....Cj....9:...g.~n..Y..7Q\v.J.../Q.....Y....i.C.......&.o7h.=nX._..AdZ..~?.$.k. .w+1.......%.C...P..e...gR......2|...yS..q..D5.,.D" .tp......7../.@.I.S'._..?\....H..F.....d....p......\0Avp.(..wN.Zv..B.4.C[...%.l..'3...F......... ....e..g.i...h9.....ub\I..P}.D...;%;......|;....%...d........>0rP.4*&[.~....d.S..ky..V.......J%.'.'!..[..z..K.D.C?.9..`.$S...?U..~.}....\....?.^..#..\!...L...X...B{.../[[`.^.n..+x...%.;+...^..=.B!.o...y.U.[8..u..6.0.Su.Uu'8>...D.gf......^7bPhV.}..F....4d1#..].._...5..e..Dc....+G3f.$t..d*.t.j...)3...9..!.-..I0.uU.u...T..T.p..^...)...,...i...e.e}..Wi.......g(.'a.ws..d'.P..%....d.P...8$|............o.].Zi..........(o.d..; `.0...X....7.H...)R..1..\......8.aF..DN.0$...V...!./.;.P..p..u..E..o~...m...-.d.u.#.....O7.i... s)...N...v.e..YW....)V...w....|..2g.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1033\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1033\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version T
                                                                        Category:dropped
                                                                        Size (bytes):5299
                                                                        Entropy (8bit):7.965060553929122
                                                                        Encrypted:false
                                                                        SSDEEP:96:TZ3hzYN6DE7QUynEhw3RrsmoN72cvrQoze3EOZx7JIBDNqHFsvQJdcCxo/KoN:TZ3JYoDE7Qh3SmGfeZglNqHFkQJdJotN
                                                                        MD5:54D2C80D657D76F8664BDAD99973F338
                                                                        SHA1:C90817C004A418D6639795AED87B3513F4046986
                                                                        SHA-256:C21CDD6242EC23D006717982A7AA055E894595FD1AA381569127D753CC461495
                                                                        SHA-512:1CBD27EDD9D278085B4F8FA31C98D29CACE3C275D92FD9515910C3690ECE2FEEEF0C37B5BBD4B0B185E7FBE634F0131A9054C462A8E6281C22126A29F42BF631
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfT..B..:...k..<.PI...N^z.0.+.}.u...3(S(".t..?55....7.!....n:._.x.iU..z.h..?Q.....%j..I.....{pq..lY..#h......p..0.c...(.L.`.....8......_.h5.<....b...L...@.P%XnA...5<.]....;.......l..:..s.....J8..(.E..y..Q.M..&..P.....(....ZT..(=.r.P._..!...1$!F...-.....$.G._%..u..x......(\.$w.P..4.p.m.8...J.bs....n.A....i"6....u.~........3C..{.....'.7.&.{..T~..W.m.8....J.2.`9.Q......-..c.i..........)F. .R...n..m...VO~.h3{u.B..H.6~..0L||...z........2.M....n..a..D4.fE.m...C..a.R|........K.K..i.....D.%=D......=9..nU~..f!.!.k?..:U.1...O.f.:..U.)...QxX..i..aL.}i.q..h...!Y.z.9.P....9..>,.......B.[......f.C...Q5..p..%.%..8,}.S-J~)4....).p|`/..<Q.V.\u...R...(`...H)...#..U..$...F.Z.-h..."A.*.}5.......p..x...q.y..4.qz.=..-....PL..!V-..P..V..,^..FDkJ.~.c.>. .Ok...-L.....rq.r......$#*./.2ttl.+..r....w5`..i..RF M......j?i....y.|.'w..+.a..9z.s......]l<..*b...5.(~WR.S)v*Z....#..G...`.M.d..X..r.|p..h...:.s.3...#X..r...g......]0\A...m.&.r....u0...[^4..y....1.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1033\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version T
                                                                        Category:dropped
                                                                        Size (bytes):5299
                                                                        Entropy (8bit):7.965060553929122
                                                                        Encrypted:false
                                                                        SSDEEP:96:TZ3hzYN6DE7QUynEhw3RrsmoN72cvrQoze3EOZx7JIBDNqHFsvQJdcCxo/KoN:TZ3JYoDE7Qh3SmGfeZglNqHFkQJdJotN
                                                                        MD5:54D2C80D657D76F8664BDAD99973F338
                                                                        SHA1:C90817C004A418D6639795AED87B3513F4046986
                                                                        SHA-256:C21CDD6242EC23D006717982A7AA055E894595FD1AA381569127D753CC461495
                                                                        SHA-512:1CBD27EDD9D278085B4F8FA31C98D29CACE3C275D92FD9515910C3690ECE2FEEEF0C37B5BBD4B0B185E7FBE634F0131A9054C462A8E6281C22126A29F42BF631
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfT..B..:...k..<.PI...N^z.0.+.}.u...3(S(".t..?55....7.!....n:._.x.iU..z.h..?Q.....%j..I.....{pq..lY..#h......p..0.c...(.L.`.....8......_.h5.<....b...L...@.P%XnA...5<.]....;.......l..:..s.....J8..(.E..y..Q.M..&..P.....(....ZT..(=.r.P._..!...1$!F...-.....$.G._%..u..x......(\.$w.P..4.p.m.8...J.bs....n.A....i"6....u.~........3C..{.....'.7.&.{..T~..W.m.8....J.2.`9.Q......-..c.i..........)F. .R...n..m...VO~.h3{u.B..H.6~..0L||...z........2.M....n..a..D4.fE.m...C..a.R|........K.K..i.....D.%=D......=9..nU~..f!.!.k?..:U.1...O.f.:..U.)...QxX..i..aL.}i.q..h...!Y.z.9.P....9..>,.......B.[......f.C...Q5..p..%.%..8,}.S-J~)4....).p|`/..<Q.V.\u...R...(`...H)...#..U..$...F.Z.-h..."A.*.}5.......p..x...q.y..4.qz.=..-....PL..!V-..P..V..,^..FDkJ.~.c.>. .Ok...-L.....rq.r......$#*./.2ttl.+..r....w5`..i..RF M......j?i....y.|.'w..+.a..9z.s......]l<..*b...5.(~WR.S)v*Z....#..G...`.M.d..X..r.|p..h...:.s.3...#X..r...g......]0\A...m.&.r....u0...[^4..y....1.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1035\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):86422
                                                                        Entropy (8bit):7.9975472737593645
                                                                        Encrypted:true
                                                                        SSDEEP:1536:RjCRAp62GnVDdQs3CwlWCVf/Z4z3m/LfHcf0NVmH6MXj7oro05XBpQCVRX7IYHVZ:U2YJ0wlWCD4aDfHZmaMTAFVNxf
                                                                        MD5:DF8DB8658AC50CF789A66FB404BE2381
                                                                        SHA1:161F7183BA744878180FA1419F0E26ACA82CC384
                                                                        SHA-256:F03DACA3DF8BC1D3D04485FE74573432DAC21C807EE9E459E1998B193AD5AE6F
                                                                        SHA-512:0ADFFF1B38FBD1D971820D6FBB1F5CDE897E99FBDF4408F32239D787FF89F41AA25F25BD9B3808EE52AEF48B95A5EA7789A7816C5EAA64ECC384F6DB2D6A3F1B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.I....>.....1.Cz:..>.c..K(".......*;...P6v.....c.*4.TtWu....7....l........7AR.4#.0.e...h..i'....|T....$1PPo.ff.o"g.].~.]S3.3..6` ..g.[...y..1....;.8..OH.'....*..../:S.mym31.......M......*I.o.....+.@:...{.}..3.?...S+......XTo..C..:^..~@rPm........Z...<].Y..H...ICLr4...]H..k4.\.."2Tr.........7..u92...`$.k]a.{6*.<3....I.....+...m..g...&]...d;..jZE......=..?..jd...."..s.1....l...X......B..^..6..*..$.f8..*..%P(34!`..M..Q..g=.@.~....*t.XW.u-..tl.q..#b.i..Cj...&.{..M...b&=..x.~...".(.z.'../...%.j."...k......X.?D..lEc]..B...(.I.....d..Y9CB........c..3....O/s~/.XIK<.u..x..[8.h.MK.U.zC+...f.U..r-..Q.y2pTQ..S.*..ZOTy|..3./.uQGoh?.D,...:..9......@=c...Hxypj.uv^..=...hW...Z..V....._...v...r39#...$.9A@y.'..)Z.#.....{......W.<.n*VM.{`&..C...I(}.d..6w.........U..6.......X. .'..1g....S`.!......?Z..<..y...sD{.F5._..EX...0.'.....*.K...N...M.T...EDR.)..oIE.Y..EbLvw..5.j..'h.5...o'....!..2.H..o.....i. _52..+....]..2....wh..J^.a.`.z...).14!...i.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1035\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):86422
                                                                        Entropy (8bit):7.9975472737593645
                                                                        Encrypted:true
                                                                        SSDEEP:1536:RjCRAp62GnVDdQs3CwlWCVf/Z4z3m/LfHcf0NVmH6MXj7oro05XBpQCVRX7IYHVZ:U2YJ0wlWCD4aDfHZmaMTAFVNxf
                                                                        MD5:DF8DB8658AC50CF789A66FB404BE2381
                                                                        SHA1:161F7183BA744878180FA1419F0E26ACA82CC384
                                                                        SHA-256:F03DACA3DF8BC1D3D04485FE74573432DAC21C807EE9E459E1998B193AD5AE6F
                                                                        SHA-512:0ADFFF1B38FBD1D971820D6FBB1F5CDE897E99FBDF4408F32239D787FF89F41AA25F25BD9B3808EE52AEF48B95A5EA7789A7816C5EAA64ECC384F6DB2D6A3F1B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.I....>.....1.Cz:..>.c..K(".......*;...P6v.....c.*4.TtWu....7....l........7AR.4#.0.e...h..i'....|T....$1PPo.ff.o"g.].~.]S3.3..6` ..g.[...y..1....;.8..OH.'....*..../:S.mym31.......M......*I.o.....+.@:...{.}..3.?...S+......XTo..C..:^..~@rPm........Z...<].Y..H...ICLr4...]H..k4.\.."2Tr.........7..u92...`$.k]a.{6*.<3....I.....+...m..g...&]...d;..jZE......=..?..jd...."..s.1....l...X......B..^..6..*..$.f8..*..%P(34!`..M..Q..g=.@.~....*t.XW.u-..tl.q..#b.i..Cj...&.{..M...b&=..x.~...".(.z.'../...%.j."...k......X.?D..lEc]..B...(.I.....d..Y9CB........c..3....O/s~/.XIK<.u..x..[8.h.MK.U.zC+...f.U..r-..Q.y2pTQ..S.*..ZOTy|..3./.uQGoh?.D,...:..9......@=c...Hxypj.uv^..=...hW...Z..V....._...v...r39#...$.9A@y.'..)Z.#.....{......W.<.n*VM.{`&..C...I(}.d..6w.........U..6.......X. .'..1g....S`.!......?Z..<..y...sD{.F5._..EX...0.'.....*.K...N...M.T...EDR.)..oIE.Y..EbLvw..5.j..'h.5...o'....!..2.H..o.....i. _52..+....]..2....wh..J^.a.`.z...).14!...i.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1035\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1035\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \230
                                                                        Category:dropped
                                                                        Size (bytes):6915
                                                                        Entropy (8bit):7.971729326334223
                                                                        Encrypted:false
                                                                        SSDEEP:192:CLR8HdfDNBT+/W1rb8JZjOUSIRIUSmadCBGi0uZ:MR8Hh3T+EHGZwIImadMGi0Y
                                                                        MD5:C5871AF9C29E09CB449FC79005C33F6C
                                                                        SHA1:045674936F45A6539AC0C3BCD704D4EEB5B1375C
                                                                        SHA-256:FC2F3517D10179BF49F45904717EA90EA27681E06CA7B105CCEB2E34180B9B80
                                                                        SHA-512:936B1C458C40469C6B2FD2A3E98AC42EB0AEACBE14F541BD5ABDE4BB410B58EEB2B23FE7B46AB1CE6EE67ABCF8CC0850C91D83A0E65F9002395C34A29554DDEB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.;..I"..../'..U...7.xv....j.9.A3.......R.._}....NW....?j.rLFj....gP......a6w.X..G~.4+a......LL_.6._KU....%qU......&.l..`.'./...~.xx.2:7..{o....!.o.....7$.cQ.aI...R....."v.\..'....s.f...D.p.....T.kN..%.\b.H..M`4..y~9.nM.......w'q...........KE...._..8..t...nr-...y....oB.*...UX@`..W..%.'.5/..<.2Q.g..K*.:....z{.....u..s%.Ehn.c..E..q.K..GO..@...29...2....n..m..u.# T._.e.3.......w...@<.9.n.....Y..b>.J.^...t<...#..I-.....m7.....ZH).nj1..X......j[Ff..`.Ia.. ......q.<)....A....a.......60.h.".p.H..g..Wa.+T.Z.6h)s.*..TG#iK|.#.....;..c.-....e..r...9%..d..E..LRu.....7.n#.....%.}j..../E.]...z..M.E.[......>.:r...M....!..I..."..5...lrqf......%.K.......0.Zs.?.@8.F.5......6.(....B...&.....y'.?..._..vOD...........K:.+../........K....W.M....|.......O...O}5...e....*......=.<X...............h.w..8..A...i.~....?....D"......E.{L]..\...MO.cm............).Y5.,.Z*..).....&=.r..f..~mg.z..9.e..W%.*S..).!`d...R......$. .....<s.zs!..A..........Yb,.X..}T..KS..2.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1035\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \230
                                                                        Category:dropped
                                                                        Size (bytes):6915
                                                                        Entropy (8bit):7.971729326334223
                                                                        Encrypted:false
                                                                        SSDEEP:192:CLR8HdfDNBT+/W1rb8JZjOUSIRIUSmadCBGi0uZ:MR8Hh3T+EHGZwIImadMGi0Y
                                                                        MD5:C5871AF9C29E09CB449FC79005C33F6C
                                                                        SHA1:045674936F45A6539AC0C3BCD704D4EEB5B1375C
                                                                        SHA-256:FC2F3517D10179BF49F45904717EA90EA27681E06CA7B105CCEB2E34180B9B80
                                                                        SHA-512:936B1C458C40469C6B2FD2A3E98AC42EB0AEACBE14F541BD5ABDE4BB410B58EEB2B23FE7B46AB1CE6EE67ABCF8CC0850C91D83A0E65F9002395C34A29554DDEB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.;..I"..../'..U...7.xv....j.9.A3.......R.._}....NW....?j.rLFj....gP......a6w.X..G~.4+a......LL_.6._KU....%qU......&.l..`.'./...~.xx.2:7..{o....!.o.....7$.cQ.aI...R....."v.\..'....s.f...D.p.....T.kN..%.\b.H..M`4..y~9.nM.......w'q...........KE...._..8..t...nr-...y....oB.*...UX@`..W..%.'.5/..<.2Q.g..K*.:....z{.....u..s%.Ehn.c..E..q.K..GO..@...29...2....n..m..u.# T._.e.3.......w...@<.9.n.....Y..b>.J.^...t<...#..I-.....m7.....ZH).nj1..X......j[Ff..`.Ia.. ......q.<)....A....a.......60.h.".p.H..g..Wa.+T.Z.6h)s.*..TG#iK|.#.....;..c.-....e..r...9%..d..E..LRu.....7.n#.....%.}j..../E.]...z..M.E.[......>.:r...M....!..I..."..5...lrqf......%.K.......0.Zs.?.@8.F.5......6.(....B...&.....y'.?..._..vOD...........K:.+../........K....W.M....|.......O...O}5...e....*......=.<X...............h.w..8..A...i.~....?....D"......E.{L]..\...MO.cm............).Y5.,.Z*..).....&=.r..f..~mg.z..9.e..W%.*S..).!`d...R......$. .....<s.zs!..A..........Yb,.X..}T..KS..2.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1036\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):90274
                                                                        Entropy (8bit):7.997949689283938
                                                                        Encrypted:true
                                                                        SSDEEP:1536:2BCZQX+v3MNpB0dtyE+V2ljb2Ys4XoZXXb2gIMKp8EDZi9BhyW+RO03oEAG:uCS+viXMtp+VEjbm44ZHb2gIMEZehrkP
                                                                        MD5:69A464C0A8DCC3515E46525A7998589B
                                                                        SHA1:47D307E8B9E260957EE5F758E5CD1FD982E408DC
                                                                        SHA-256:37BB47E49538D204E038A023E0FF3F86B19E9B928E054BEA0EFC8061738BCEF2
                                                                        SHA-512:8BA0C864E6F9530F38EB883CCA8908A72969652A0A56BCFA44F04113621411A569D3DFD9D399DDA709F111A8A9DFB000A9DBEA666C77AC653CE8E693EA4425E5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.LP.\.\.]..j..?..,h...c.&+.p.../..T`..]...s.q.{,..7..............U.*..I.i.Tq..v.Fv...@...jOa..q..@...Yoq.;..h...!ix..\.}...S."..Y U.%.n...PR6..U....a..BX.Z.pD.....i)......K...Q^..|H..,^.<.r+]...3/...,.qL..4.j&...w.4..!..&...vy=..}D..#8...X.[...C.L.`...sCm......{..%_.j.S-vB3.:..A...5W.....x..V..0Q........x....7....AU.1.yaK.1J..K.4.......%Gw.+T.J.,.o....4,p......6.#L.b..?.:ga.'.l.p..A..2.U...s...i....F.@{........+bXkL(.2z.H./..%D.E.gQ.|...)~,.T,N'.asx5..)..~,...@=_...+ ..j..|.'...w.?.W.."..;e....p...n....f..~_{2......G8.tN..I...V.;_.F.rh..c.m....,..l.R..x.>.......7p.~......W.xu..FXR.......u~...bD...Y\...2....,*....|.e.jx.U.O...G.}E,....[..S..E..@.!.R.p..#.t.......ug..h/....$T....O...e...Bt.Q...5..E...M..w..bM;...>.(.=zPC.%.......=..<..C..fe.....v(.....g.#......Furc....c7..P....9.}<pF'N.Mj_...[g*.....|...E.k..S...#!..#zZL......~....kl...96U...N.....5....i..4......t...R...i....naOMy.(..D.,1S..'Fe.I3r=h<N.....N.Z5..I.g..o.......{.....n....0....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1036\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):90274
                                                                        Entropy (8bit):7.997949689283938
                                                                        Encrypted:true
                                                                        SSDEEP:1536:2BCZQX+v3MNpB0dtyE+V2ljb2Ys4XoZXXb2gIMKp8EDZi9BhyW+RO03oEAG:uCS+viXMtp+VEjbm44ZHb2gIMEZehrkP
                                                                        MD5:69A464C0A8DCC3515E46525A7998589B
                                                                        SHA1:47D307E8B9E260957EE5F758E5CD1FD982E408DC
                                                                        SHA-256:37BB47E49538D204E038A023E0FF3F86B19E9B928E054BEA0EFC8061738BCEF2
                                                                        SHA-512:8BA0C864E6F9530F38EB883CCA8908A72969652A0A56BCFA44F04113621411A569D3DFD9D399DDA709F111A8A9DFB000A9DBEA666C77AC653CE8E693EA4425E5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.LP.\.\.]..j..?..,h...c.&+.p.../..T`..]...s.q.{,..7..............U.*..I.i.Tq..v.Fv...@...jOa..q..@...Yoq.;..h...!ix..\.}...S."..Y U.%.n...PR6..U....a..BX.Z.pD.....i)......K...Q^..|H..,^.<.r+]...3/...,.qL..4.j&...w.4..!..&...vy=..}D..#8...X.[...C.L.`...sCm......{..%_.j.S-vB3.:..A...5W.....x..V..0Q........x....7....AU.1.yaK.1J..K.4.......%Gw.+T.J.,.o....4,p......6.#L.b..?.:ga.'.l.p..A..2.U...s...i....F.@{........+bXkL(.2z.H./..%D.E.gQ.|...)~,.T,N'.asx5..)..~,...@=_...+ ..j..|.'...w.?.W.."..;e....p...n....f..~_{2......G8.tN..I...V.;_.F.rh..c.m....,..l.R..x.>.......7p.~......W.xu..FXR.......u~...bD...Y\...2....,*....|.e.jx.U.O...G.}E,....[..S..E..@.!.R.p..#.t.......ug..h/....$T....O...e...Bt.Q...5..E...M..w..bM;...>.(.=zPC.%.......=..<..C..fe.....v(.....g.#......Furc....c7..P....9.}<pF'N.Mj_...[g*.....|...E.k..S...#!..#zZL......~....kl...96U...N.....5....i..4......t...R...i....naOMy.(..D.,1S..'Fe.I3r=h<N.....N.Z5..I.g..o.......{.....n....0....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1036\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1036\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \262
                                                                        Category:dropped
                                                                        Size (bytes):7205
                                                                        Entropy (8bit):7.97667166714776
                                                                        Encrypted:false
                                                                        SSDEEP:192:dgx6e1bu2/f+ekmrvtOITBL0vdcNJzJSukmDvdpNXZS7:dgPbxhrvtOuAvd8houvDFbXc
                                                                        MD5:1274202BBB3390DCD2172A63E032C696
                                                                        SHA1:952CBCDA44C123B6353827455A51AF0258F4BA17
                                                                        SHA-256:544061722ACC7E8B7121F4A659369B4DF5C3E4EBC067797F2C2E5A718E484900
                                                                        SHA-512:56DE45F8E03A93D5C813DD0150D6970F1E08566D7D9E02A562EEF24CFE2529C2B080C250205A46908B475EAAD8001683991B6D59734F5020797BA9F3B9166367
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf....s...e...=..M.v"....?...h.G(s./....7...w..k$...D8.R,..J..^(.K-\p..n^?.....K..M..I.Y=f..zZ...V.h.iD'.t8%.jN.K'.g\.#.8.<.$K..ePN3nW3.i.e...*R.%..Il...Z........+|...7o..H.F&'..).<-..../...V......F....Jf$}..J*....Z...^rbJ..B..L..h..I8#pI.I.;...p.'8M...4.U...f.@Z..5f....I..lO2..h..[..Bjb.r..2...@.i...8..q/5>....&......d.x.O1.r.!./..u........I.#!'XJ.~..$.....}.?{d..........P,]}..M.f.^..m)_3acJ..~..F....Jl..^Fh..3...!NC.g\.(..a...Q.V.!:)'Q..v..a. ........z.[.6...P.<Ub..Es$m..9.{...-.....b..F..~l.y.WEx...D..^P.*...a].2Ou.`.D.*.....B.{.:.1.*...W..e:|.... G.0..$...o~Y...n=.....V..+D.5m...%....G a.0....;....B.V.N.....zI..U2.FE.>...r#.......|....Tl}3....CV....<..w../Wg.p............dI.`4...._..Z.....$N.B.N..?'.zg.k...;.`.G..O.2R#.....7..@..pQXj.,8....9jG.YE.{.....]!ZxL.i.?.$w.......8Wa;KH.\..u.SZ....WS..M...t..vE.....>="4....o-.i.\S..f.7...".%.*.v.~>Y....]9vuX...9*.xy....S.L.q...Q.C<~jx.K...ve."..%M..)S.............:..%.....................8

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1036\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \262
                                                                        Category:dropped
                                                                        Size (bytes):7205
                                                                        Entropy (8bit):7.97667166714776
                                                                        Encrypted:false
                                                                        SSDEEP:192:dgx6e1bu2/f+ekmrvtOITBL0vdcNJzJSukmDvdpNXZS7:dgPbxhrvtOuAvd8houvDFbXc
                                                                        MD5:1274202BBB3390DCD2172A63E032C696
                                                                        SHA1:952CBCDA44C123B6353827455A51AF0258F4BA17
                                                                        SHA-256:544061722ACC7E8B7121F4A659369B4DF5C3E4EBC067797F2C2E5A718E484900
                                                                        SHA-512:56DE45F8E03A93D5C813DD0150D6970F1E08566D7D9E02A562EEF24CFE2529C2B080C250205A46908B475EAAD8001683991B6D59734F5020797BA9F3B9166367
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf....s...e...=..M.v"....?...h.G(s./....7...w..k$...D8.R,..J..^(.K-\p..n^?.....K..M..I.Y=f..zZ...V.h.iD'.t8%.jN.K'.g\.#.8.<.$K..ePN3nW3.i.e...*R.%..Il...Z........+|...7o..H.F&'..).<-..../...V......F....Jf$}..J*....Z...^rbJ..B..L..h..I8#pI.I.;...p.'8M...4.U...f.@Z..5f....I..lO2..h..[..Bjb.r..2...@.i...8..q/5>....&......d.x.O1.r.!./..u........I.#!'XJ.~..$.....}.?{d..........P,]}..M.f.^..m)_3acJ..~..F....Jl..^Fh..3...!NC.g\.(..a...Q.V.!:)'Q..v..a. ........z.[.6...P.<Ub..Es$m..9.{...-.....b..F..~l.y.WEx...D..^P.*...a].2Ou.`.D.*.....B.{.:.1.*...W..e:|.... G.0..$...o~Y...n=.....V..+D.5m...%....G a.0....;....B.V.N.....zI..U2.FE.>...r#.......|....Tl}3....CV....<..w../Wg.p............dI.`4...._..Z.....$N.B.N..?'.zg.k...;.`.G..O.2R#.....7..@..pQXj.,8....9jG.YE.{.....]!ZxL.i.?.$w.......8Wa;KH.\..u.SZ....WS..M...t..vE.....>="4....o-.i.\S..f.7...".%.*.v.~>Y....]9vuX...9*.xy....S.L.q...Q.C<~jx.K...ve."..%M..)S.............:..%.....................8

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1037\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):80926
                                                                        Entropy (8bit):7.998065126401456
                                                                        Encrypted:true
                                                                        SSDEEP:1536:C9EE9SbAdiY9gCRRmPJ4o5Mh5YSCeMN6pW2ZAuDUbEErh13RU:C9EE9SbU19gCOPmAMhGSNpL7Ub3hJRU
                                                                        MD5:C402239CC673F8E533FF6F2CF2A60F11
                                                                        SHA1:A762D08D120F14E413A714FC87929901ED01243A
                                                                        SHA-256:A1791A8D504B28A1CAADCBE4D6537A65D516C97E4D4ECE24387A65F5388A2770
                                                                        SHA-512:785792CCE1D0FB3EA84C3711340CDB9E9AD46A27EDFDC50BABE78463C6AD924ACC5F079EB1C795BC2C39179411884460854C0D61F6AA104AEBA5B578025E8C8E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..1aON.$mL).Z..S.;.?R...J.{~.4f...R...b..>' ..".Bx..,...B......3...b.t..l....t....UZ...V.u.k..aZ...-..P...Su...e..ubv~<.6..z..[9.H(.......iqs.....8.....!.,.82....J8B2./!?H..<.V/....q.....^.n../..L>..m..z...B....9b. .t.....17...N...R.v....s..b`..w{.w.c&.p+.n.f=e|.G.;x.2...q..OP.)..+.(..c.f..e|...z.W....O.....__,.....Y+hs.6...z~..sj....._5.Z.7...Z$....&..!..,.9..S".K.}M.y.&...~.??..O.e/.J..j..5.4).Ne.y..x.Ox.-`..>..K.X4...."wn..L(.+.........kP....v...E._5M.0.Ad..pFj...&...?.n.xZ..5........e..9.m...7JbY..2%pz..(.v.iZ40.3.xC..s....Sh....8..gj..xza....M.....8.b.m..q...`..g..b...?+.+.L_Mbg.$A]xWL..%..E..i.....Ni..6tm.].I......t..\/...0.m........~g..".....~.on......=.v...........W/M,B...\_......G.S.#}o4.N.*^$.@.un..._...m?.F...fmE....i..&....r.gp...@HSM.r=...W.q.>A!.....e...t.v......^.......*.AE.~G....[^....k..x........,P.T........s<....D.H1..'...Y.O...<..Y.M.P&,"...r|.f9.Bh.0..V..j\.!1N.i.....a."$....U....<...u...yE.9.O..`.F:-;..b.@P6D*.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1037\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):80926
                                                                        Entropy (8bit):7.998065126401456
                                                                        Encrypted:true
                                                                        SSDEEP:1536:C9EE9SbAdiY9gCRRmPJ4o5Mh5YSCeMN6pW2ZAuDUbEErh13RU:C9EE9SbU19gCOPmAMhGSNpL7Ub3hJRU
                                                                        MD5:C402239CC673F8E533FF6F2CF2A60F11
                                                                        SHA1:A762D08D120F14E413A714FC87929901ED01243A
                                                                        SHA-256:A1791A8D504B28A1CAADCBE4D6537A65D516C97E4D4ECE24387A65F5388A2770
                                                                        SHA-512:785792CCE1D0FB3EA84C3711340CDB9E9AD46A27EDFDC50BABE78463C6AD924ACC5F079EB1C795BC2C39179411884460854C0D61F6AA104AEBA5B578025E8C8E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..1aON.$mL).Z..S.;.?R...J.{~.4f...R...b..>' ..".Bx..,...B......3...b.t..l....t....UZ...V.u.k..aZ...-..P...Su...e..ubv~<.6..z..[9.H(.......iqs.....8.....!.,.82....J8B2./!?H..<.V/....q.....^.n../..L>..m..z...B....9b. .t.....17...N...R.v....s..b`..w{.w.c&.p+.n.f=e|.G.;x.2...q..OP.)..+.(..c.f..e|...z.W....O.....__,.....Y+hs.6...z~..sj....._5.Z.7...Z$....&..!..,.9..S".K.}M.y.&...~.??..O.e/.J..j..5.4).Ne.y..x.Ox.-`..>..K.X4...."wn..L(.+.........kP....v...E._5M.0.Ad..pFj...&...?.n.xZ..5........e..9.m...7JbY..2%pz..(.v.iZ40.3.xC..s....Sh....8..gj..xza....M.....8.b.m..q...`..g..b...?+.+.L_Mbg.$A]xWL..%..E..i.....Ni..6tm.].I......t..\/...0.m........~g..".....~.on......=.v...........W/M,B...\_......G.S.#}o4.N.*^$.@.un..._...m?.F...fmE....i..&....r.gp...@HSM.r=...W.q.>A!.....e...t.v......^.......*.AE.~G....[^....k..x........,P.T........s<....D.H1..'...Y.O...<..Y.M.P&,"...r|.f9.Bh.0..V..j\.!1N.i.....a."$....U....<...u...yE.9.O..`.F:-;..b.@P6D*.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1037\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1037\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \215
                                                                        Category:dropped
                                                                        Size (bytes):13173
                                                                        Entropy (8bit):7.988189396772855
                                                                        Encrypted:false
                                                                        SSDEEP:192:HY/ZxPVQ0IGCWjFm0WUK0Ofgx3TxHQ9rkPdpe3jyO9U8GY0fGpEUAhDZAh3p98/b:HmJVPIU9OfyTqrG7L8pmRUODZGZ9wMlk
                                                                        MD5:674284EA83BB825E95365DCAFFE6CBF8
                                                                        SHA1:C2B8DBBB9C40782EE64153B12A593F30B4F172CE
                                                                        SHA-256:247A1F056962697C84546E62A8C34E94E441B984068B56972A22EBA61D186B18
                                                                        SHA-512:B36BC44C549E30E8EE2B84BAB2B4ABDD8BC2A1B44D0E45145253EB95D2B6C50E6BFCBEEF77FE02F46579A52CB7F0E2B9E0B92811005FF0C104DE60F8CCC013EB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.}.....I.5..6..\...F...^.R.G.\...c..8R..C......tE"...(<.=......i..Z. .".r.nhZ`.z..y6.t..XG....j>.^.O\u+2....N2.9.0... ..-...G..]&.5..Fd4.{.(]U.c.Y...yH...6+=PdX|...$.o{/._.sTG].E~....^.3v....-.....HC...T...z......(.F..v{....2..M..si).n.. E..WE....@.+....-r....8..Ra.?7n;H.vlG.4.....O...L.vi.....!...P...{...Z.y..9..L....u9.M...Q>...p.1.AZ..)..a.=.U..H"....].h.m).T..........o..........N.;.Gw...&z...6.....X.. #...R....v.6..........].!.f...(8.*..u;.K6...F.A[T..VgU./..=G.n...^......L....).%.{.G..d...j......@.H..qK.)..'T....2.c$.. .rX.a..6...o......r.w.........1.C...,71p3..".'.s!.6...h,......_.dD.o...e..8...Qr..t.p.L.;..[AB..M.......[......Q........6..J.......q..D%....me..f..e.&u..E.p.^..Wg.."..m...D.y8.].QU#..~t)<.gj\.Z.Uo.T!.....w%.(.e;...*."..U...+.....C.....o...j.A...R.A.+....Y..O...ue^.....Ty*..OFr...'R.M.....V#X.?....r..U.....\..}......d.J.^..#.}@$E.M..*.......XC..6.(C.?x......&V@...\..>...@A.9...A..~:~Og[..<O..B.....B..S.......k.|.D

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1037\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \215
                                                                        Category:dropped
                                                                        Size (bytes):13173
                                                                        Entropy (8bit):7.988189396772855
                                                                        Encrypted:false
                                                                        SSDEEP:192:HY/ZxPVQ0IGCWjFm0WUK0Ofgx3TxHQ9rkPdpe3jyO9U8GY0fGpEUAhDZAh3p98/b:HmJVPIU9OfyTqrG7L8pmRUODZGZ9wMlk
                                                                        MD5:674284EA83BB825E95365DCAFFE6CBF8
                                                                        SHA1:C2B8DBBB9C40782EE64153B12A593F30B4F172CE
                                                                        SHA-256:247A1F056962697C84546E62A8C34E94E441B984068B56972A22EBA61D186B18
                                                                        SHA-512:B36BC44C549E30E8EE2B84BAB2B4ABDD8BC2A1B44D0E45145253EB95D2B6C50E6BFCBEEF77FE02F46579A52CB7F0E2B9E0B92811005FF0C104DE60F8CCC013EB
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.}.....I.5..6..\...F...^.R.G.\...c..8R..C......tE"...(<.=......i..Z. .".r.nhZ`.z..y6.t..XG....j>.^.O\u+2....N2.9.0... ..-...G..]&.5..Fd4.{.(]U.c.Y...yH...6+=PdX|...$.o{/._.sTG].E~....^.3v....-.....HC...T...z......(.F..v{....2..M..si).n.. E..WE....@.+....-r....8..Ra.?7n;H.vlG.4.....O...L.vi.....!...P...{...Z.y..9..L....u9.M...Q>...p.1.AZ..)..a.=.U..H"....].h.m).T..........o..........N.;.Gw...&z...6.....X.. #...R....v.6..........].!.f...(8.*..u;.K6...F.A[T..VgU./..=G.n...^......L....).%.{.G..d...j......@.H..qK.)..'T....2.c$.. .rX.a..6...o......r.w.........1.C...,71p3..".'.s!.6...h,......_.dD.o...e..8...Qr..t.p.L.;..[AB..M.......[......Q........6..J.......q..D%....me..f..e.&u..E.p.^..Wg.."..m...D.y8.].QU#..~t)<.gj\.Z.Uo.T!.....w%.(.e;...*."..U...+.....C.....o...j.A...R.A.+....Y..O...ue^.....Ty*..OFr...'R.M.....V#X.?....r..U.....\..}......d.J.^..#.}@$E.M..*.......XC..6.(C.?x......&V@...\..>...@A.9...A..~:~Og[..<O..B.....B..S.......k.|.D

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1038\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):89362
                                                                        Entropy (8bit):7.997980985023463
                                                                        Encrypted:true
                                                                        SSDEEP:1536:TGA9wvPHm2ijCwE0qw6Xuhk6wNftMl8KPrF6oirtu6nyGYpy8TD:yA9t9CwEHXuhk6GutYoU7YpZX
                                                                        MD5:3B992216C9EF5A3C65643D085244B654
                                                                        SHA1:F55CD35BCF3BAE526D16CC41570F36BCA3E3C133
                                                                        SHA-256:444668FEC1F074A0211C15AC0F7724E2B353E456C54A6DDF6B1A93AF9BEC9CBB
                                                                        SHA-512:4E48B93E5CD5ACC95331202339312AFBE213EE6341481F876ECFB4A312DB406E734A062848A5539CDB18DE314A6AC8659CA1B1522B843661D76BEBCF3480C0A3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.?.1..p...#X....K...2.,...tW.5..^.....n.0..N..{...ET...F..o.c.'....Rm.?W.].q.....-..J.e....2.._..6...~H ..t5w.....)_D!.j......#?.xr..[c.....;......LD....=..(.r..LL..u'.t.=..!/.-..LF..^..k...C.3..?.3.1..Y<?.....l.)H...E...4......v...*@..e.M.w...x.q..`..ye....q...V..0...j[..D.z..#gq.c.ln..T...]...4f....=.....k..R..ff ..nC..a..^..j....U...M.u....&Oe.'.)/U....I.._.`..!...I"...P.7.@..;.......+X!...y..e(f...on..{.....1#0..Ta..2.....,.. .0.....1..*|T'..I....P....M|LR.S%AOJ. ..M.U.BGz..Vi....SX...k....U.W.C@HV.(j.9.5...-j.ASDv.!.b.....)../.....ck..g.=.\.7..E...@....!$.q..X...qR9..[,..W.Z......}..)..Pg....L..U....6.+...$/zg${c1.e..#B.vf.h.d5.H..%.%....Z.]. ;5.7...4ik.XG.%.f.~{.6.:<K.....v.d.pCh.O5a4\v.1e..P/....Oe.\<;Z......_.}......m...u;....[..+...~.t.ur...O...0V..D....h....kE..... .lMo.`qb..1.t.M.V./)fw.a...3U.=.M$..A...,........~.*<l.\!...*..d?...vY.};.=....J.zB.N.C..U...F......0...b..D)[.J.Q.aA.W6..f.{i.M.4.c-...);.!...q.....}v......,.@K+yqOu..0...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1038\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):89362
                                                                        Entropy (8bit):7.997980985023463
                                                                        Encrypted:true
                                                                        SSDEEP:1536:TGA9wvPHm2ijCwE0qw6Xuhk6wNftMl8KPrF6oirtu6nyGYpy8TD:yA9t9CwEHXuhk6GutYoU7YpZX
                                                                        MD5:3B992216C9EF5A3C65643D085244B654
                                                                        SHA1:F55CD35BCF3BAE526D16CC41570F36BCA3E3C133
                                                                        SHA-256:444668FEC1F074A0211C15AC0F7724E2B353E456C54A6DDF6B1A93AF9BEC9CBB
                                                                        SHA-512:4E48B93E5CD5ACC95331202339312AFBE213EE6341481F876ECFB4A312DB406E734A062848A5539CDB18DE314A6AC8659CA1B1522B843661D76BEBCF3480C0A3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.?.1..p...#X....K...2.,...tW.5..^.....n.0..N..{...ET...F..o.c.'....Rm.?W.].q.....-..J.e....2.._..6...~H ..t5w.....)_D!.j......#?.xr..[c.....;......LD....=..(.r..LL..u'.t.=..!/.-..LF..^..k...C.3..?.3.1..Y<?.....l.)H...E...4......v...*@..e.M.w...x.q..`..ye....q...V..0...j[..D.z..#gq.c.ln..T...]...4f....=.....k..R..ff ..nC..a..^..j....U...M.u....&Oe.'.)/U....I.._.`..!...I"...P.7.@..;.......+X!...y..e(f...on..{.....1#0..Ta..2.....,.. .0.....1..*|T'..I....P....M|LR.S%AOJ. ..M.U.BGz..Vi....SX...k....U.W.C@HV.(j.9.5...-j.ASDv.!.b.....)../.....ck..g.=.\.7..E...@....!$.q..X...qR9..[,..W.Z......}..)..Pg....L..U....6.+...$/zg${c1.e..#B.vf.h.d5.H..%.%....Z.]. ;5.7...4ik.XG.%.f.~{.6.:<K.....v.d.pCh.O5a4\v.1e..P/....Oe.\<;Z......_.}......m...u;....[..+...~.t.ur...O...0V..D....h....kE..... .lMo.`qb..1.t.M.V./)fw.a...3U.=.M$..A...,........~.*<l.\!...*..d?...vY.};.=....J.zB.N.C..U...F......0...b..D)[.J.Q.aA.W6..f.{i.M.4.c-...);.!...q.....}v......,.@K+yqOu..0...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1038\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1038\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version ]
                                                                        Category:dropped
                                                                        Size (bytes):7852
                                                                        Entropy (8bit):7.976776911030196
                                                                        Encrypted:false
                                                                        SSDEEP:192:Pr8jw0Ffx+TQ4G98EBKcb+++HrK6lO+62vbnt4x:PYjw0F5JHwcb+Lth62y
                                                                        MD5:C769A443D747B49E1AB4E16D2C60331F
                                                                        SHA1:49BCF9452BA87F3D879641CF90FEC487015F5A32
                                                                        SHA-256:D631AA53B41FEFDBDB12D5C49B442693D8C09C77FBCEFA4957214BBC7BC39E6B
                                                                        SHA-512:F70CF5E9D1C02D91C92A60F1C5D929C0752DD4CB0CE66459971351A344DCDBC1613423CEBA0D3BB5949FC001F1B8BFC89B7427F94315FE5B960628F4F6389161
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf].Fvq.}..k..b*.aM~G...(.|....*...0.....[$...........{_R.....C.n...88'...,....F..J.H*.8.[R.G...JR.:.j.8..;.8.T_`.Z"..YI...'O.J<w.uF.."..!.U..D[..x^"..'..Q...[.K.....F......O.#$..E......v..Q...-...S...&>P:...3."..y......9.......zR.GK..]..u.>l..L[...L..fb;.......\.'.3+..w....|[u..c.....R...(.....OIGV.[.P...k...B.i.......;,.L..Y.)!.7Wc3.........X!.7J.WpiLj..v...K`.^.Q.W....,L..}^...|.m-..kP.....%u....?K....s..r..'...'|k.aZ....H.....N.#.F..,.F..L@IY...UT.h(lJK.1!...<....#1...~..`.".zu6............,.:E.t..3M..F%n(^...8.(.=.......f.p..S...$......nw?:.......-...."`.n...J.2'.(....?\.q.TT..l..4...W..........b.....[..N....s..............=.[....0v.V.?s;..L...s...O..}~..~.z..0.@[.s.!.i.....!...R*...t.R.N.DI9.5....Bs..4@.%.O2.|.F.6`.........L....n}.a...X6A.........5...44.;D.w.EA%=.0...?.P..E<.i...W..^....}...M....['.T.kps...i........r.%.Br.l.h.$>.\.{\#..#;.....8..*.|...k...uo..\$.....x~.TCn."*....bW]k.....F....>"..K*.D..`.r..!.E....9.|-.~.d.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1038\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version ]
                                                                        Category:dropped
                                                                        Size (bytes):7852
                                                                        Entropy (8bit):7.976776911030196
                                                                        Encrypted:false
                                                                        SSDEEP:192:Pr8jw0Ffx+TQ4G98EBKcb+++HrK6lO+62vbnt4x:PYjw0F5JHwcb+Lth62y
                                                                        MD5:C769A443D747B49E1AB4E16D2C60331F
                                                                        SHA1:49BCF9452BA87F3D879641CF90FEC487015F5A32
                                                                        SHA-256:D631AA53B41FEFDBDB12D5C49B442693D8C09C77FBCEFA4957214BBC7BC39E6B
                                                                        SHA-512:F70CF5E9D1C02D91C92A60F1C5D929C0752DD4CB0CE66459971351A344DCDBC1613423CEBA0D3BB5949FC001F1B8BFC89B7427F94315FE5B960628F4F6389161
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf].Fvq.}..k..b*.aM~G...(.|....*...0.....[$...........{_R.....C.n...88'...,....F..J.H*.8.[R.G...JR.:.j.8..;.8.T_`.Z"..YI...'O.J<w.uF.."..!.U..D[..x^"..'..Q...[.K.....F......O.#$..E......v..Q...-...S...&>P:...3."..y......9.......zR.GK..]..u.>l..L[...L..fb;.......\.'.3+..w....|[u..c.....R...(.....OIGV.[.P...k...B.i.......;,.L..Y.)!.7Wc3.........X!.7J.WpiLj..v...K`.^.Q.W....,L..}^...|.m-..kP.....%u....?K....s..r..'...'|k.aZ....H.....N.#.F..,.F..L@IY...UT.h(lJK.1!...<....#1...~..`.".zu6............,.:E.t..3M..F%n(^...8.(.=.......f.p..S...$......nw?:.......-...."`.n...J.2'.(....?\.q.TT..l..4...W..........b.....[..N....s..............=.[....0v.V.?s;..L...s...O..}~..~.z..0.@[.s.!.i.....!...R*...t.R.N.DI9.5....Bs..4@.%.O2.|.F.6`.........L....n}.a...X6A.........5...44.;D.w.EA%=.0...?.P..E<.i...W..^....}...M....['.T.kps...i........r.%.Br.l.h.$>.\.{\#..#;.....8..*.|...k...uo..\$.....x~.TCn."*....bW]k.....F....>"..K*.D..`.r..!.E....9.|-.~.d.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1040\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88210
                                                                        Entropy (8bit):7.998057110690521
                                                                        Encrypted:true
                                                                        SSDEEP:1536:zlh6fBCIL0CxRSGtthm846Esvz3QlqQQkvYBIhDOkj1szdzhqsNlkAAbJ9CB42j:PhIQqJtht4TMIqr3IhDO4ahhqhxbJwG0
                                                                        MD5:E8C9C1D00EECA97F3A1C505F0914ED38
                                                                        SHA1:A620B58F9E580BA79C3EEC75A2011B1B8C901687
                                                                        SHA-256:7E5F5FEB9C180A8D481DAB6B57559D6B26A1D15281982D06A3E51C06B84B0C56
                                                                        SHA-512:547B49FCAB77D2E662F965D1FE463445C86DBFD79332042FFC1746471524C53E9885B17639FEEBF218CF821D81A52A5A723D3CC69FABB3C10647B596D93C629A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?....Ge...Z.b.......-...P.x....b.x...t..rd..&{..@"6#..'.9.:.~..0.....0.v!.u....@[...JH..*...Hb>...s......QY..8de(..}.aKv9}...w..zeN1.....(....>..hK4.K)m.D.t...<e..[r........P..%.Z...4.6.SU},.si.5 ..D&$....M.X.....I.;"P%...s...M.+.;"1..v...$p#V.......O.+.*.7..!u.:w.J.ZixqI..r...7...).../.=.1L..s.&v....j....O6....nLbA.]..8.W.Q...-....u....c\.5.......A"I..\..{..n....:.c........t7.<.(....X.TL.U....O..*{}..fM.gQ.:........../....0.<'..%-....N.&7.v...+o..{....Q-..^0...w...V..|n.!.CB.[....t+L2G.........DuGv..._..@`>...^.#...-.S...s..x.@8...p..!rG]wS7.!T. ...`.82K..zl.k@U.fQ..-....-.M;..<..n..6.TQp..B.....&.}ao..E..gP....-..Z|.{c.b.zWAU.@....i[.|..^xRt.7.WL...sf-5Q.IB..]...R.....*p..>y]...\..9}F..]...m..7.g.+..W.gjdl..(0r]#..}...c......Wo1.z{..5CA...G....g......N.iHo..&G.....v...sX6w......!o....5.;df.....`.7...*..hI.Xz.A...@:6.....`.EK.d.~.5..o....5eB+u..;..u.Qf.\..0.X..$.n.r.Nxv....S...]..sJ.|4".v.)...b.lU.\....+.N.7.....8..Z..,......)..e.(^...^y..6.g

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1040\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88210
                                                                        Entropy (8bit):7.998057110690521
                                                                        Encrypted:true
                                                                        SSDEEP:1536:zlh6fBCIL0CxRSGtthm846Esvz3QlqQQkvYBIhDOkj1szdzhqsNlkAAbJ9CB42j:PhIQqJtht4TMIqr3IhDO4ahhqhxbJwG0
                                                                        MD5:E8C9C1D00EECA97F3A1C505F0914ED38
                                                                        SHA1:A620B58F9E580BA79C3EEC75A2011B1B8C901687
                                                                        SHA-256:7E5F5FEB9C180A8D481DAB6B57559D6B26A1D15281982D06A3E51C06B84B0C56
                                                                        SHA-512:547B49FCAB77D2E662F965D1FE463445C86DBFD79332042FFC1746471524C53E9885B17639FEEBF218CF821D81A52A5A723D3CC69FABB3C10647B596D93C629A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?....Ge...Z.b.......-...P.x....b.x...t..rd..&{..@"6#..'.9.:.~..0.....0.v!.u....@[...JH..*...Hb>...s......QY..8de(..}.aKv9}...w..zeN1.....(....>..hK4.K)m.D.t...<e..[r........P..%.Z...4.6.SU},.si.5 ..D&$....M.X.....I.;"P%...s...M.+.;"1..v...$p#V.......O.+.*.7..!u.:w.J.ZixqI..r...7...).../.=.1L..s.&v....j....O6....nLbA.]..8.W.Q...-....u....c\.5.......A"I..\..{..n....:.c........t7.<.(....X.TL.U....O..*{}..fM.gQ.:........../....0.<'..%-....N.&7.v...+o..{....Q-..^0...w...V..|n.!.CB.[....t+L2G.........DuGv..._..@`>...^.#...-.S...s..x.@8...p..!rG]wS7.!T. ...`.82K..zl.k@U.fQ..-....-.M;..<..n..6.TQp..B.....&.}ao..E..gP....-..Z|.{c.b.zWAU.@....i[.|..^xRt.7.WL...sf-5Q.IB..]...R.....*p..>y]...\..9}F..]...m..7.g.+..W.gjdl..(0r]#..}...c......Wo1.z{..5CA...G....g......N.iHo..&G.....v...sX6w......!o....5.;df.....`.7...*..hI.Xz.A...@:6.....`.EK.d.~.5..o....5eB+u..;..u.Qf.\..0.X..$.n.r.Nxv....S...]..sJ.|4".v.)...b.lU.\....+.N.7.....8..Z..,......)..e.(^...^y..6.g

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1040\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1040\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version C
                                                                        Category:dropped
                                                                        Size (bytes):6677
                                                                        Entropy (8bit):7.968823137375036
                                                                        Encrypted:false
                                                                        SSDEEP:192:U7aBERxmBK25gSywJsZNbsl/vjrGm8cFj:UW2TmERwCZJsl/vj5
                                                                        MD5:A0801755B657FA2931D881C01EC7F47E
                                                                        SHA1:66FC6275E22D9CCF75C5552D7E1FE1812B82AA93
                                                                        SHA-256:62209B55892D7193E2FAE658E25EDDBF36A119FEB080D6EED105E6AA58518D44
                                                                        SHA-512:FBF42F4562D1B0F4336F33B6B8FA421B4B07649A8D87C19F895FA78B5AFB93FDDDEFD96448D5C3474D53701C4CB419FDB7A354BAF3421AA93E77CB762BC7769A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfC......?5.gW.0..,k...Z..Z4......e.=T...n...[zn=."xi59..r..0h...)...#h..e.Y.'..._.....a@.......~.t...ps.=~..h....-.j....F.Kt...7.34......+7.(..E.k.=&H;&T.)G..G.e...m.....M...{......>v.O....N,"*05.t..#..,..f...UX..5..v...-..=+..nq.r^_3Z....o....<.3.G.....ZlIE..@3..@..qX.H...pU.N.H. .".B......<.a?.......\v....z.`3...*.NM.Z......'...dX3.F....%.....?r....l.x....?......t.S..).q..`.3.F..%~H.2b..g..Fg.@...%....9... ..rr...."....!K.0.-....R$8..d...........D..,W....V_.71<R..fR..b........."<.>..........*4n........~....PG4.n...,R...OB<.*E)RP...XP.%...............$t..z2...CgA3$...q......A...C<..m,.....0.....jNi.B.u.X...'R..Y...^l..M.ev6.m..a.zH..).>U.4.._.....5.n>.P..g.......(.'.o..c84F.|...+.u.*..NZ.6..A...........6MK.Q9B#.{`;+.....<.}KHr. ..^.JK....M/2./....u.......^..l...|..._.7\.J..s.Y.5G.Sp.......R7.!...(..D...mXO..V]....x7-........V....P.on........@=.x..p...5h.)g...>i.h....&....=@}.}Sd.tKq=..6.e.........[v=<g...I.9s.......b%B._.."-|.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1040\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version C
                                                                        Category:dropped
                                                                        Size (bytes):6677
                                                                        Entropy (8bit):7.968823137375036
                                                                        Encrypted:false
                                                                        SSDEEP:192:U7aBERxmBK25gSywJsZNbsl/vjrGm8cFj:UW2TmERwCZJsl/vj5
                                                                        MD5:A0801755B657FA2931D881C01EC7F47E
                                                                        SHA1:66FC6275E22D9CCF75C5552D7E1FE1812B82AA93
                                                                        SHA-256:62209B55892D7193E2FAE658E25EDDBF36A119FEB080D6EED105E6AA58518D44
                                                                        SHA-512:FBF42F4562D1B0F4336F33B6B8FA421B4B07649A8D87C19F895FA78B5AFB93FDDDEFD96448D5C3474D53701C4CB419FDB7A354BAF3421AA93E77CB762BC7769A
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfC......?5.gW.0..,k...Z..Z4......e.=T...n...[zn=."xi59..r..0h...)...#h..e.Y.'..._.....a@.......~.t...ps.=~..h....-.j....F.Kt...7.34......+7.(..E.k.=&H;&T.)G..G.e...m.....M...{......>v.O....N,"*05.t..#..,..f...UX..5..v...-..=+..nq.r^_3Z....o....<.3.G.....ZlIE..@3..@..qX.H...pU.N.H. .".B......<.a?.......\v....z.`3...*.NM.Z......'...dX3.F....%.....?r....l.x....?......t.S..).q..`.3.F..%~H.2b..g..Fg.@...%....9... ..rr...."....!K.0.-....R$8..d...........D..,W....V_.71<R..fR..b........."<.>..........*4n........~....PG4.n...,R...OB<.*E)RP...XP.%...............$t..z2...CgA3$...q......A...C<..m,.....0.....jNi.B.u.X...'R..Y...^l..M.ev6.m..a.zH..).>U.4.._.....5.n>.P..g.......(.'.o..c84F.|...+.u.*..NZ.6..A...........6MK.Q9B#.{`;+.....<.}KHr. ..^.JK....M/2./....u.......^..l...|..._.7\.J..s.Y.5G.Sp.......R7.!...(..D...mXO..V]....x7-........V....P.on........@=.x..p...5h.)g...>i.h....&....=@}.}Sd.tKq=..6.e.........[v=<g...I.9s.......b%B._.."-|.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1041\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):77300
                                                                        Entropy (8bit):7.9979052303382705
                                                                        Encrypted:true
                                                                        SSDEEP:1536:u0vyaa0Ps5hXwuQWS1Hgjg23Oh400pPP3q84m+Cv9VqyDTWXvSwcZ:6Z0PO1EPAjg8+4Dfq8FvjqyPW/SwG
                                                                        MD5:F36311D9A3A201C2F22873B604A1A72B
                                                                        SHA1:8CB970D441368AE50BD40E314B947A2E0659CACD
                                                                        SHA-256:435DC4170B1F8945F80353E3CC997CE0299AFB25B297AE7CFD97F5131C10F43C
                                                                        SHA-512:4C45C26DE3A37BE4348237DF152C5FFB51E550FC00AEA6B3511C3CAFFA2E9AEF4FC942B0DEAF056CB75519E6CF2F9956AA4B3CB94E6F0112F3FF9847C1AB791D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..T..Q..t..p8...#...:Y...J@.7?.0.MY.... .........k.I..A21..8.3..!x....>o..Am..|.+..CLt......_..R[!B.3..A`d."..^..p.g..%.....jT..;..9..4z9.zi.l.FB..f .%.......zB].EOx....g..clMM.)..I@.Yq.LMl..'..@<..Kt.../VZf..P.!D4..{.}c...t....x.F.........v.r.Q.G./..r...#*..;I..z.o..a.Ai..=.{|..n}U..)..:OD.QI..y.~.......4........+......E.gO...4..:.#.E,7..W..J.k..o.5..}...H8.X..;../..e..-...1u..T.f.u.&kf.....-^.......w888.Y..^q.)gS.2.[".Ia{B7....H.../T.t..........sq..vf.S.O[;..M...*.ZCw.{.w.1..4H...yC...3F.....;...g.c...M)z.l...5.a...y.t.i.*...y..R#[..........-...5..ukG`..W.......l...]u..%...........m.m7L2.....$.&$._..a>..P.06#.....M....y.........Z8..h.f....C...G..:.[v.+.j.0i._;..'..oE).(...-7.....g.....^..R.V.K.I.'..]..k_.l..j....T|@...Dk.......M.....hO..dD...PZ.jo...,../.2..!O..q!..w.U...2.T".j...T...t.5/1f.vW.l_......~.j..{....t..T..\so.x.D0gS.....=.1.e..\...oY\A..tziM..$!..'.........Si...........*%.y.j."....p.sU.%..% .\...2.....z....'..S....m..<B`

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1041\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):77300
                                                                        Entropy (8bit):7.9979052303382705
                                                                        Encrypted:true
                                                                        SSDEEP:1536:u0vyaa0Ps5hXwuQWS1Hgjg23Oh400pPP3q84m+Cv9VqyDTWXvSwcZ:6Z0PO1EPAjg8+4Dfq8FvjqyPW/SwG
                                                                        MD5:F36311D9A3A201C2F22873B604A1A72B
                                                                        SHA1:8CB970D441368AE50BD40E314B947A2E0659CACD
                                                                        SHA-256:435DC4170B1F8945F80353E3CC997CE0299AFB25B297AE7CFD97F5131C10F43C
                                                                        SHA-512:4C45C26DE3A37BE4348237DF152C5FFB51E550FC00AEA6B3511C3CAFFA2E9AEF4FC942B0DEAF056CB75519E6CF2F9956AA4B3CB94E6F0112F3FF9847C1AB791D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..T..Q..t..p8...#...:Y...J@.7?.0.MY.... .........k.I..A21..8.3..!x....>o..Am..|.+..CLt......_..R[!B.3..A`d."..^..p.g..%.....jT..;..9..4z9.zi.l.FB..f .%.......zB].EOx....g..clMM.)..I@.Yq.LMl..'..@<..Kt.../VZf..P.!D4..{.}c...t....x.F.........v.r.Q.G./..r...#*..;I..z.o..a.Ai..=.{|..n}U..)..:OD.QI..y.~.......4........+......E.gO...4..:.#.E,7..W..J.k..o.5..}...H8.X..;../..e..-...1u..T.f.u.&kf.....-^.......w888.Y..^q.)gS.2.[".Ia{B7....H.../T.t..........sq..vf.S.O[;..M...*.ZCw.{.w.1..4H...yC...3F.....;...g.c...M)z.l...5.a...y.t.i.*...y..R#[..........-...5..ukG`..W.......l...]u..%...........m.m7L2.....$.&$._..a>..P.06#.....M....y.........Z8..h.f....C...G..:.[v.+.j.0i._;..'..oE).(...-7.....g.....^..R.V.K.I.'..]..k_.l..j....T|@...Dk.......M.....hO..dD...PZ.jo...,../.2..!O..q!..w.U...2.T".j...T...t.5/1f.vW.l_......~.j..{....t..T..\so.x.D0gS.....=.1.e..\...oY\A..tziM..$!..'.........Si...........*%.y.j."....p.sU.%..% .\...2.....z....'..S....m..<B`

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1041\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1041\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \205
                                                                        Category:dropped
                                                                        Size (bytes):18315
                                                                        Entropy (8bit):7.992173075534863
                                                                        Encrypted:true
                                                                        SSDEEP:384:bbvD/PmrYWrbRHwhQcosWV5SCBzp2VcTSBgUnkrPxwkob:bbvD/PGYINQXe4rBANwrb
                                                                        MD5:B4312082A0DBDA85B7A9989E5C72806D
                                                                        SHA1:ECB98DB06BC364384F33CAB0B7B6E7032B0BE7AA
                                                                        SHA-256:3734E00F2A1997AC2A6741AFE43666D35A36C7F365299E98AA6FCAE29CD2AD96
                                                                        SHA-512:9FF7A0B24F1C0B9311494ACF26C95962D002C0A7F1EBAB3482ECE74898D8459B401176EADD971980C0107A516D211CDC1F84CA637119F6DA2621B87B93F74430
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:{\rtf..W......s.!.....zQ.N.C:'....lt.;'........D....S.,E.0Pb...bQ....9.).......*..F.I.|...~.e.....P.....&.\%..../..^..M..o..|k..7..~..8%&....`.9...MD.s..L...d1(.*.v.+{;....>+......!..P......=0P@j.A[...... .g.n..c.3.g.8.?8.!....b.....),v......4f.Vx....Pd..X'.fM...Nbn.3...a.Tp..y.}......#.=@.n....g.*..2.#6qN.p......oc.O.@7B...U.a.o..'..(..UE...#..K:.V...DP ../S.9kcC..Af.............1.JU.-.5..d.. .|8X-...T.l.&x8.g..@..I.t(..E.n...?......(H..5.7.*..H.-..1.E.Hu.fg...k....k..j....$.LC..}p.........p..*......e,o...N.b..;.".h...G#.,:..j.....aBl_.I.....MW..kQ0Y....0..u..VZ.@5........R.Ewo....X.G..|d.......b.l"o5.g....*.#;d..3.......~A....[.Y.s..U.......B.Ru7.`......u..v.B..........'......X..M..E.w..I.......L{.\......!de...D......'}.'w;._..[d.[...d3e.kI.O.'.Y>n....R...?r..9.....Rt;.>.........T....b.G5.Hh...f}..\E.t...2..?..C.{...=...Y....H..Bb..f.{.Q.H.....T..rc.Q!.?........J.b.....A..r.4."..hv.j$.@...c{..1{.kFg...W..8....k.......'7'Wz..0W

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1041\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \205
                                                                        Category:dropped
                                                                        Size (bytes):18315
                                                                        Entropy (8bit):7.992173075534863
                                                                        Encrypted:true
                                                                        SSDEEP:384:bbvD/PmrYWrbRHwhQcosWV5SCBzp2VcTSBgUnkrPxwkob:bbvD/PGYINQXe4rBANwrb
                                                                        MD5:B4312082A0DBDA85B7A9989E5C72806D
                                                                        SHA1:ECB98DB06BC364384F33CAB0B7B6E7032B0BE7AA
                                                                        SHA-256:3734E00F2A1997AC2A6741AFE43666D35A36C7F365299E98AA6FCAE29CD2AD96
                                                                        SHA-512:9FF7A0B24F1C0B9311494ACF26C95962D002C0A7F1EBAB3482ECE74898D8459B401176EADD971980C0107A516D211CDC1F84CA637119F6DA2621B87B93F74430
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:{\rtf..W......s.!.....zQ.N.C:'....lt.;'........D....S.,E.0Pb...bQ....9.).......*..F.I.|...~.e.....P.....&.\%..../..^..M..o..|k..7..~..8%&....`.9...MD.s..L...d1(.*.v.+{;....>+......!..P......=0P@j.A[...... .g.n..c.3.g.8.?8.!....b.....),v......4f.Vx....Pd..X'.fM...Nbn.3...a.Tp..y.}......#.=@.n....g.*..2.#6qN.p......oc.O.@7B...U.a.o..'..(..UE...#..K:.V...DP ../S.9kcC..Af.............1.JU.-.5..d.. .|8X-...T.l.&x8.g..@..I.t(..E.n...?......(H..5.7.*..H.-..1.E.Hu.fg...k....k..j....$.LC..}p.........p..*......e,o...N.b..;.".h...G#.,:..j.....aBl_.I.....MW..kQ0Y....0..u..VZ.@5........R.Ewo....X.G..|d.......b.l"o5.g....*.#;d..3.......~A....[.Y.s..U.......B.Ru7.`......u..v.B..........'......X..M..E.w..I.......L{.\......!de...D......'}.'w;._..[d.[...d3e.kI.O.'.Y>n....R...?r..9.....Rt;.>.........T....b.G5.Hh...f}..\E.t...2..?..C.{...=...Y....H..Bb..f.{.Q.H.....T..rc.Q!.?........J.b.....A..r.4."..hv.j$.@...c{..1{.kFg...W..8....k.......'7'Wz..0W

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1042\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):75552
                                                                        Entropy (8bit):7.997238941239506
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ZG84SdWg2JQBwtLWGdYjdBWxqRLkI1xYsCWevSY7hvFdrG3N:IiW6BwtWGKjdBWxqaWWHpGd
                                                                        MD5:7AB649931BDC61E93FCF96D3907F7F98
                                                                        SHA1:BD7B8D54B8D3DA1CD5581D1025106CF6396FD169
                                                                        SHA-256:7AF91BD5459E4C2078E182FA3474418EFFA392C56BCEB33A0D1AF3DAC1A8750D
                                                                        SHA-512:EF07618FD2DA69C23A8AA4FBA573ECF849F1C1C13B01A5EB156925EB532911C6730601B7EB7D86BD0C6EC4E0B515371B4CA070609D4DA6F2F479990E6A0F56CC
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...PI:......].Mk.1>..dew.&..".b.).$84..gh.....*o(s..;.._...k..8....!....}$3..Jd.. ...W......p......!7?.Yw..1:W.G..g...y..n..".gEc. ..(+..YV$...n.q../....@.f)%.D^..........[.riN...).;8...>.u.....S.....p.....WP.I.q.g].,N*.D...i..I3.....iC..yJ.Ja\....z.)7..!..T..I..d.I?<..v.O.b...6..Rl.4>`.....B....l...G.9.xR.O.2]..D..]..dQ....\....j...Q...,.;.~.dd9..?..1....B...x.E.......r..q.l].HU...h.vc...'{.V...........b...A...{$(..=.v.l}...C....3i4..MH.74.u....l.u.... ......H.eLu.R.s.G..x.i~...?&\....#.....\..:....Rz...eD.[F.]C...+.V.t...go`..y-.[.i.[J....#...y.|.w....+..U.V....N...f._.Pb?=...R`aW..bE.G..E..1.\.B.C......+......T.)/<M.._..B....|;.Z......5......=`l.K@.....P0....T.s...$..5`b........J.W.o..SR....WH .....{.w......\.\x..-lT.n.qe..C.s...0.WMi.0uE..*.. 0....[_:...V...O..H...{..L.^...l...../~O.......q..m.Y....>.Z^..V....."..1.......@wv?..1z}D.}i.."....b"E......V.\.ZW-..b....(u.....O/N.V...x*(>Y.;...+.nc.hG+....`.I...?n..=....S..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1042\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):75552
                                                                        Entropy (8bit):7.997238941239506
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ZG84SdWg2JQBwtLWGdYjdBWxqRLkI1xYsCWevSY7hvFdrG3N:IiW6BwtWGKjdBWxqaWWHpGd
                                                                        MD5:7AB649931BDC61E93FCF96D3907F7F98
                                                                        SHA1:BD7B8D54B8D3DA1CD5581D1025106CF6396FD169
                                                                        SHA-256:7AF91BD5459E4C2078E182FA3474418EFFA392C56BCEB33A0D1AF3DAC1A8750D
                                                                        SHA-512:EF07618FD2DA69C23A8AA4FBA573ECF849F1C1C13B01A5EB156925EB532911C6730601B7EB7D86BD0C6EC4E0B515371B4CA070609D4DA6F2F479990E6A0F56CC
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...PI:......].Mk.1>..dew.&..".b.).$84..gh.....*o(s..;.._...k..8....!....}$3..Jd.. ...W......p......!7?.Yw..1:W.G..g...y..n..".gEc. ..(+..YV$...n.q../....@.f)%.D^..........[.riN...).;8...>.u.....S.....p.....WP.I.q.g].,N*.D...i..I3.....iC..yJ.Ja\....z.)7..!..T..I..d.I?<..v.O.b...6..Rl.4>`.....B....l...G.9.xR.O.2]..D..]..dQ....\....j...Q...,.;.~.dd9..?..1....B...x.E.......r..q.l].HU...h.vc...'{.V...........b...A...{$(..=.v.l}...C....3i4..MH.74.u....l.u.... ......H.eLu.R.s.G..x.i~...?&\....#.....\..:....Rz...eD.[F.]C...+.V.t...go`..y-.[.i.[J....#...y.|.w....+..U.V....N...f._.Pb?=...R`aW..bE.G..E..1.\.B.C......+......T.)/<M.._..B....|;.Z......5......=`l.K@.....P0....T.s...$..5`b........J.W.o..SR....WH .....{.w......\.\x..-lT.n.qe..C.s...0.WMi.0uE..*.. 0....[_:...V...O..H...{..L.^...l...../~O.......q..m.Y....>.Z^..V....."..1.......@wv?..1z}D.}i.."....b"E......V.\.ZW-..b....(u.....O/N.V...x*(>Y.;...+.nc.hG+....`.I...?n..=....S..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1042\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1042\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \206
                                                                        Category:dropped
                                                                        Size (bytes):17527
                                                                        Entropy (8bit):7.990078506894352
                                                                        Encrypted:true
                                                                        SSDEEP:384:V5J9BvpgmywGxzH7ra1WR5TqFi2EddESK2mOMrr:V1BvDe17raIR5Tw0URXv
                                                                        MD5:2DF0BFC50A12980A9BC7A7DD590E7A04
                                                                        SHA1:0AC2B2B77F78860454A3BDA297CD8B89B73BF6C4
                                                                        SHA-256:E2F3147464E3DA4940D47FCF64FD1BFF9DC43D240C9C2501E6152354E19E0505
                                                                        SHA-512:1AF69D0B07B7F940532EF0F4E8A3D0AB8DC23F561C8F3E241B380FCB38058C6552A4F1502754D265AF18274878885FA2C23882468282E8022F397CB710931FD3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:{\rtf.+.O).1..(...B.Nj...z..G.y..n.<.w<.Ny.....l...6.d.....p............JoV.uMw.. .O.5.,*.}....%.........%.......pb$1...|..J..".K:.g..........I.T.<.y..b.7!c.Bbz!.{$w..../......1m..l.......u.....u.D.A..:n.K.%s[q..W.... .pT...g..2.=.~-.5..j..}.._..P6@>B.IG..L`...../N....):...# ..a...+..n......s.:S..q.....'.....H..sT...!_a....[..l..f1.A{.1..l.u..*.rw.$bio...U.[c............J...N..*.........a.C..<pURYQ*}D.j............k*#f..KY.h.tU.+..A(.d.X..R..........^.d.d.W.......*....$...e||...?...'.O_.3.lI...wk..+...rt.D}(....-..e..Z5.h'>v...o...x@^0$..r...1..f(M..B.......`V6X...W.x.[%.....EcQ...4...a.#..k.t-@..K"..c..ov.Q....[..e.y.I..|.`.xe2.m.....d..=.3.c.}..D..6).X...A..p....:O.uI..VGnsv......B3e.........Im8.Lp.....].p:....rZ.\o..R..*.k....z\..\....J:+a2.0......[..'.?*...<.?.F....k2......(7Y_.[...X....q.a/...A....).6#1..u.nde..:f.r....2....S..~...'e.....u..*.C....;..{.6.V.....,0?....H?g:..N.....d...!./i7.*..u^.K@.U6.R~.).&....~.t....._.$.?........n..Y(.......

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1042\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \206
                                                                        Category:dropped
                                                                        Size (bytes):17527
                                                                        Entropy (8bit):7.990078506894352
                                                                        Encrypted:true
                                                                        SSDEEP:384:V5J9BvpgmywGxzH7ra1WR5TqFi2EddESK2mOMrr:V1BvDe17raIR5Tw0URXv
                                                                        MD5:2DF0BFC50A12980A9BC7A7DD590E7A04
                                                                        SHA1:0AC2B2B77F78860454A3BDA297CD8B89B73BF6C4
                                                                        SHA-256:E2F3147464E3DA4940D47FCF64FD1BFF9DC43D240C9C2501E6152354E19E0505
                                                                        SHA-512:1AF69D0B07B7F940532EF0F4E8A3D0AB8DC23F561C8F3E241B380FCB38058C6552A4F1502754D265AF18274878885FA2C23882468282E8022F397CB710931FD3
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:{\rtf.+.O).1..(...B.Nj...z..G.y..n.<.w<.Ny.....l...6.d.....p............JoV.uMw.. .O.5.,*.}....%.........%.......pb$1...|..J..".K:.g..........I.T.<.y..b.7!c.Bbz!.{$w..../......1m..l.......u.....u.D.A..:n.K.%s[q..W.... .pT...g..2.=.~-.5..j..}.._..P6@>B.IG..L`...../N....):...# ..a...+..n......s.:S..q.....'.....H..sT...!_a....[..l..f1.A{.1..l.u..*.rw.$bio...U.[c............J...N..*.........a.C..<pURYQ*}D.j............k*#f..KY.h.tU.+..A(.d.X..R..........^.d.d.W.......*....$...e||...?...'.O_.3.lI...wk..+...rt.D}(....-..e..Z5.h'>v...o...x@^0$..r...1..f(M..B.......`V6X...W.x.[%.....EcQ...4...a.#..k.t-@..K"..c..ov.Q....[..e.y.I..|.`.xe2.m.....d..=.3.c.}..D..6).X...A..p....:O.uI..VGnsv......B3e.........Im8.Lp.....].p:....rZ.\o..R..*.k....z\..\....J:+a2.0......[..'.?*...<.?.F....k2......(7Y_.[...X....q.a/...A....).6#1..u.nde..:f.r....2....S..~...'e.....u..*.C....;..{.6.V.....,0?....H?g:..N.....d...!./i7.*..u^.K@.U6.R~.).&....~.t....._.$.?........n..Y(.......

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1043\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87760
                                                                        Entropy (8bit):7.997919862184628
                                                                        Encrypted:true
                                                                        SSDEEP:1536:3gcxvTTI02i1yqj2C9wG4Na9i/R1z9CxsuiW0yjPldwpp2wHMNbK4ZJ/YKbAU/6F:nvTTI02jXo2Nci5t9CIWz9Ep2wHMNJYn
                                                                        MD5:4AB0BF59AFDD0AF9DAF0181934BE5601
                                                                        SHA1:92A351891DB3B5F0F12E30D399CA353E9976387B
                                                                        SHA-256:CF6DEFAF82318F9391C5AE989F971B6D367F33D562DB7E454E61A6BA062F168E
                                                                        SHA-512:22EE73AE6820BF73313D8159DF3FD8F11B54BCFC44FB7872B40E6C7DEA8EF9A11ED7918C906C55C932209F05F73C2AC1FF95AEEE65735F018609E815F6DFB46B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.;%.....s........p....m...D......]...W..(.O{....U\..q..Hq..-.|..b...$o.?T..a..7..h\.......3^g..UOf.L....].el...h.-=J..p...B.>..^'.......O..}sl...9......<M...g.eJ.I..Q.....r..tS,Y.\&.0"..x/o....-.J...'O...@..].4.w3...Sa..-^..w&.......[0Y..2..{.ak.4..5...........7RF....|.m.)..g.|L...5R.?...."J'.D.....l.B.f...q.+..I.|R...Pf?.u)EE_...4..J..=.]`..`....g..f"..X/..M.<.y.x.s6{.....%d...:../..U.....O.X...c....Il..s28.a.R../)_.q@.\..+........\..r.....N.......@?.........l$.e...v..Z@.,........O...@....~....W1>../.N".....E.2R..n...;l/...E..P.~.i............*bz....^.].h.........#5..&.\.k<.v!.(..m.z>y..#...__.):.@0..+........H....ru...'V...P.4.........W... .B.....9}..8..4.\.>.FG......&n.....j+.:T.|.o..;sl.Y91~..w...)... ...h.Mn.&C....'.S...U^.'..x.7.Q..Tr(..S3..q.c..?......c5.vQ.m...)8J.['..6...FD.&k....n.[oj.N..b......Z.,$.X=vS.n..P.m..>h.....*5gF..oF?1@...M..x3.a.4#.o..m.I..._l.J.....E...q.A...;N...X.B}..%..K..F.t.c.KoD..At...dR....:+r.#y.c....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1043\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87760
                                                                        Entropy (8bit):7.997919862184628
                                                                        Encrypted:true
                                                                        SSDEEP:1536:3gcxvTTI02i1yqj2C9wG4Na9i/R1z9CxsuiW0yjPldwpp2wHMNbK4ZJ/YKbAU/6F:nvTTI02jXo2Nci5t9CIWz9Ep2wHMNJYn
                                                                        MD5:4AB0BF59AFDD0AF9DAF0181934BE5601
                                                                        SHA1:92A351891DB3B5F0F12E30D399CA353E9976387B
                                                                        SHA-256:CF6DEFAF82318F9391C5AE989F971B6D367F33D562DB7E454E61A6BA062F168E
                                                                        SHA-512:22EE73AE6820BF73313D8159DF3FD8F11B54BCFC44FB7872B40E6C7DEA8EF9A11ED7918C906C55C932209F05F73C2AC1FF95AEEE65735F018609E815F6DFB46B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.;%.....s........p....m...D......]...W..(.O{....U\..q..Hq..-.|..b...$o.?T..a..7..h\.......3^g..UOf.L....].el...h.-=J..p...B.>..^'.......O..}sl...9......<M...g.eJ.I..Q.....r..tS,Y.\&.0"..x/o....-.J...'O...@..].4.w3...Sa..-^..w&.......[0Y..2..{.ak.4..5...........7RF....|.m.)..g.|L...5R.?...."J'.D.....l.B.f...q.+..I.|R...Pf?.u)EE_...4..J..=.]`..`....g..f"..X/..M.<.y.x.s6{.....%d...:../..U.....O.X...c....Il..s28.a.R../)_.q@.\..+........\..r.....N.......@?.........l$.e...v..Z@.,........O...@....~....W1>../.N".....E.2R..n...;l/...E..P.~.i............*bz....^.].h.........#5..&.\.k<.v!.(..m.z>y..#...__.):.@0..+........H....ru...'V...P.4.........W... .B.....9}..8..4.\.>.FG......&n.....j+.:T.|.o..;sl.Y91~..w...)... ...h.Mn.&C....'.S...U^.'..x.7.Q..Tr(..S3..q.c..?......c5.vQ.m...)8J.['..6...FD.&k....n.[oj.N..b......Z.,$.X=vS.n..P.m..>h.....*5gF..oF?1@...M..x3.a.4#.o..m.I..._l.J.....E...q.A...;N...X.B}..%..K..F.t.c.KoD..At...dR....:+r.#y.c....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1043\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1043\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version "
                                                                        Category:dropped
                                                                        Size (bytes):6299
                                                                        Entropy (8bit):7.969357239555213
                                                                        Encrypted:false
                                                                        SSDEEP:96:SOQtrlBbzMwczz+zxgO3EIRCq5nuzJ3mhalyt5gliWkdFNUkHPf5pk+I4:7QhlBbzni+zSIJsytZpnn3TF
                                                                        MD5:257E9D032594E4259811D42EC4DEDE46
                                                                        SHA1:ABFA04338365370B7520F36DD44794008DC7DFE0
                                                                        SHA-256:52A42449F9C2FBD734D08669A0E2042A538D26827AF1FD2B94FFEB56938AD19C
                                                                        SHA-512:6120EEFF3C3B57CE2FF0B14B18BF3A4E073B11C38C8FF7AF385E713A5EC6E7E5DE6BE965E31B298DF7BDFD31AEF87B0D30B0ACEFAA9DDA6F2D4DD700B866EA90
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf"..X>}[..........=*.p.`....7....u.X...4....z(..y.....B../..#.....%.g......a.l.....*...M...B?A...w....P.......D..+t%...`.v:........YT.."E.h.\....n.,[..G.>.J/Br.....W<X.n(...f.R....+.. ...5.R./....Vbf..4.,_|.+.........f0....'a.hvwi.....&....Y..V....D.l.f|lA@.!.J...v.m._nv.:...m\A........pp.6........Yg....f+.YZ3.bfq..j..(Y.z.[x>......."x...~..4.4.i...(.....lt'.Q$`....).....#.. ....._..,.xL.%F..%........J....x..x.l....(!.....[......WS...g.w)...h..dg...$Wf5......5.D.x...s>u. ..".....&,..nj.l8P..c...kAVM....F..hC....V...S<...Q..V;K..0.M.u\#_5...N.w.z.....C.9M....CuPr..Fena.Z........_...}X...~..h..@./..';+"..I...~..lV...k9..7....^.O...f.c...........2....i..'.)p....,..|..P..H.$.p.#....Cz,y...7Z3..F.E.?.R..#i.U8..CWQ...j...}."....;2{.9.=.@..U....#-.ZA.U..8-r`jks.X.R..p.....C.e...N.3h....0..k...)...sj..b...0.m_.c..$.....'..5.......:.....Wz!../.....7WDF........J.Z.e.;.|D|..O..a..d..O....o..8.....:..p.N.....g...b...9)...k...=??.7R..8>..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1043\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version "
                                                                        Category:dropped
                                                                        Size (bytes):6299
                                                                        Entropy (8bit):7.969357239555213
                                                                        Encrypted:false
                                                                        SSDEEP:96:SOQtrlBbzMwczz+zxgO3EIRCq5nuzJ3mhalyt5gliWkdFNUkHPf5pk+I4:7QhlBbzni+zSIJsytZpnn3TF
                                                                        MD5:257E9D032594E4259811D42EC4DEDE46
                                                                        SHA1:ABFA04338365370B7520F36DD44794008DC7DFE0
                                                                        SHA-256:52A42449F9C2FBD734D08669A0E2042A538D26827AF1FD2B94FFEB56938AD19C
                                                                        SHA-512:6120EEFF3C3B57CE2FF0B14B18BF3A4E073B11C38C8FF7AF385E713A5EC6E7E5DE6BE965E31B298DF7BDFD31AEF87B0D30B0ACEFAA9DDA6F2D4DD700B866EA90
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf"..X>}[..........=*.p.`....7....u.X...4....z(..y.....B../..#.....%.g......a.l.....*...M...B?A...w....P.......D..+t%...`.v:........YT.."E.h.\....n.,[..G.>.J/Br.....W<X.n(...f.R....+.. ...5.R./....Vbf..4.,_|.+.........f0....'a.hvwi.....&....Y..V....D.l.f|lA@.!.J...v.m._nv.:...m\A........pp.6........Yg....f+.YZ3.bfq..j..(Y.z.[x>......."x...~..4.4.i...(.....lt'.Q$`....).....#.. ....._..,.xL.%F..%........J....x..x.l....(!.....[......WS...g.w)...h..dg...$Wf5......5.D.x...s>u. ..".....&,..nj.l8P..c...kAVM....F..hC....V...S<...Q..V;K..0.M.u\#_5...N.w.z.....C.9M....CuPr..Fena.Z........_...}X...~..h..@./..';+"..I...~..lV...k9..7....^.O...f.c...........2....i..'.)p....,..|..P..H.$.p.#....Cz,y...7Z3..F.E.?.R..#i.U8..CWQ...j...}."....;2{.9.=.@..U....#-.ZA.U..8-r`jks.X.R..p.....C.e...N.3h....0..k...)...sj..b...0.m_.c..$.....'..5.......:.....Wz!../.....7WDF........J.Z.e.;.|D|..O..a..d..O....o..8.....:..p.N.....g...b...9)...k...=??.7R..8>..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1044\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87244
                                                                        Entropy (8bit):7.997348425376653
                                                                        Encrypted:true
                                                                        SSDEEP:1536:hCAoPj+mG+wIh/6wa9/+JCc0TTkVZmPNWHqf12+VV25o0fdjSGiJ6ewIdz/9Dnn5:9oPjU1ISgJCc/qL01evTD9Dn5
                                                                        MD5:5D8337FE95D5B96E0C29F81F6B5B1DFC
                                                                        SHA1:80DDE4A1150B776A7EBB3F61A33448487320A936
                                                                        SHA-256:E896452774E202AE66DC0130B818F57C018C1A4489FD5F5ACB7387BF1DC4D689
                                                                        SHA-512:1F659FAC5953C4D20C98A276812834AA958BFE52C03D8E324CE433F50ACC35E8E5CA2FC49F3235B188A8B536677B1F7D9B8439C187B91568C74A65199588D02E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?Z.F.g.r.[.....!.....1.A>....~.Y.7...*}.4.`u.a.8.H|.a.QzqC.s.s..9!O........).p.@....g".V.>...M...oJn?.s0.a..af.....j..L..mU;..E#..t..t..X...|...=... .D....z.1..O..4c..n..j.{..d,'y.#&.g.U4G..~B ..{:.....0.......F.R...<@X&\R....s)......p.<$.........cg....:..Kx.$c"R..\ .....p.<X.tAXg.gy5....T.a...th.r..T...>...R9..&.u....\............#Y..d.nM.XC6..5}....T_;...$.zg5.Bse......V.?.M...2.B...?..u.b!<..|60W.\..)f.R...jAXQ....xi..#.@.(.>.4.1?..3N.........}k..G.+.:...,..(.w.X....~...I .K..H"... ..%......!.M/e!c.g.......i......#5.......~.n..".xm...Y:.P..Q[:lvS<.. W$....w...(.39...X..(?M.$^.<.U+..).l.I..l.f.d..c........I\....u....;..f.:sN`.-o.t.9...Fx.....p....1.l.:.1.P..0.J....By...eDg....,.jp.).Q.C9;i|...k..85..+\s..eu[r.q..%.z.e...U.#.[.p...8.j...!.].O..j.J<.&..m...>.....J..0=UJ7.RK3.^T.b)......DK0..p.<G..&..}.&^..W....m+.W.C$.#ux.OW_.........:)..Y.zY..R.r.r.r...1..O..C...3.........qo............. .M.EZp.r.W..:B....JH....]..*....UP^.1Z..t2...9iF

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1044\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87244
                                                                        Entropy (8bit):7.997348425376653
                                                                        Encrypted:true
                                                                        SSDEEP:1536:hCAoPj+mG+wIh/6wa9/+JCc0TTkVZmPNWHqf12+VV25o0fdjSGiJ6ewIdz/9Dnn5:9oPjU1ISgJCc/qL01evTD9Dn5
                                                                        MD5:5D8337FE95D5B96E0C29F81F6B5B1DFC
                                                                        SHA1:80DDE4A1150B776A7EBB3F61A33448487320A936
                                                                        SHA-256:E896452774E202AE66DC0130B818F57C018C1A4489FD5F5ACB7387BF1DC4D689
                                                                        SHA-512:1F659FAC5953C4D20C98A276812834AA958BFE52C03D8E324CE433F50ACC35E8E5CA2FC49F3235B188A8B536677B1F7D9B8439C187B91568C74A65199588D02E
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?Z.F.g.r.[.....!.....1.A>....~.Y.7...*}.4.`u.a.8.H|.a.QzqC.s.s..9!O........).p.@....g".V.>...M...oJn?.s0.a..af.....j..L..mU;..E#..t..t..X...|...=... .D....z.1..O..4c..n..j.{..d,'y.#&.g.U4G..~B ..{:.....0.......F.R...<@X&\R....s)......p.<$.........cg....:..Kx.$c"R..\ .....p.<X.tAXg.gy5....T.a...th.r..T...>...R9..&.u....\............#Y..d.nM.XC6..5}....T_;...$.zg5.Bse......V.?.M...2.B...?..u.b!<..|60W.\..)f.R...jAXQ....xi..#.@.(.>.4.1?..3N.........}k..G.+.:...,..(.w.X....~...I .K..H"... ..%......!.M/e!c.g.......i......#5.......~.n..".xm...Y:.P..Q[:lvS<.. W$....w...(.39...X..(?M.$^.<.U+..).l.I..l.f.d..c........I\....u....;..f.:sN`.-o.t.9...Fx.....p....1.l.:.1.P..0.J....By...eDg....,.jp.).Q.C9;i|...k..85..+\s..eu[r.q..%.z.e...U.#.[.p...8.j...!.].O..j.J<.&..m...>.....J..0=UJ7.RK3.^T.b)......DK0..p.<G..&..}.&^..W....m+.W.C$.#ux.OW_.........:)..Y.zY..R.r.r.r...1..O..C...3.........qo............. .M.EZp.r.W..:B....JH....]..*....UP^.1Z..t2...9iF

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1044\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1044\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \226
                                                                        Category:dropped
                                                                        Size (bytes):5983
                                                                        Entropy (8bit):7.970407199474661
                                                                        Encrypted:false
                                                                        SSDEEP:96:/tPHxErGAxenkpWRQZoUNCES19ghULviiiSPCdf2Oh2FT:Jgx3pmQZvCES19gKTriSPC0a2R
                                                                        MD5:67368CEB4764DB8B5FBCED8959DD55C1
                                                                        SHA1:AB25E4F523D25D95C01F89923466755C2597BB0C
                                                                        SHA-256:D2D564177FB5F6CD03D209CC7A383F314ED7F6A5F7DA654508C38BC24DC12991
                                                                        SHA-512:39E6B104271AB13DCE1FE67E712CC9F6CE43A2A174CC3BE9ED879B3BAE1123289114E130CA81823BB5FF4DCD7FF9CE2441FEFAC7D95B4F3DB3136C78D2FF8480
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf....U..o.dm.#.WA}.|#.4z.6...T8=&.....r..2T.hdq.9..O..-.+.Npz.D.i....`...|...J;0.J.W.g.V*..)Ag...I.r......d.]/.V ....J....L.UQ.\?J.G..#....I.|.+....../L+b.]... .np...o....exA...<6...v...~...........$SvR.9B.{...=......7'.Cs7.4..ca.4...E.pe....:.,.=..,..N..(.9.k...;.:C....W..j....r.:&N..A..c`...4.r. C......a........}V.2..<..o...9.n*.I..h.Ky.....[.....)b....p.R.#`"In.....-#..W{.h.?[..$.(....S.. .6.P...^...%..._.<...J.\...u...}..i.F....LGv...Bf......$mR85`..R1....[..M5...._^....c.$.....JO...X....\J.7...4q.....r..^..Y.gQ..)f...~" ..X4...;...V.E/......qJ~..p8....N.....L..P.6.m*y..8.-.....%... .B\~..................3N.M....:j^1j..,0N.w..x.............!..Ne.!...v..~.#7;.,..\...!.D.?....<..+._vV!.\..` .....j:....M.....-=.$.a......8..u.%a.7x.J......Rf[......b..1.lR..N8...._kZ...j.............v.mR..2......C.!../.jp....m.lN)~..V.{.>.F.4...K+.^\....N.:.&/..u"s......V..S.|1x.C.*F..i/..E...y.y...0Q.=...C.............NS..j.X.k.._k(2......E..f.....J;.NC..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1044\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \226
                                                                        Category:dropped
                                                                        Size (bytes):5983
                                                                        Entropy (8bit):7.970407199474661
                                                                        Encrypted:false
                                                                        SSDEEP:96:/tPHxErGAxenkpWRQZoUNCES19ghULviiiSPCdf2Oh2FT:Jgx3pmQZvCES19gKTriSPC0a2R
                                                                        MD5:67368CEB4764DB8B5FBCED8959DD55C1
                                                                        SHA1:AB25E4F523D25D95C01F89923466755C2597BB0C
                                                                        SHA-256:D2D564177FB5F6CD03D209CC7A383F314ED7F6A5F7DA654508C38BC24DC12991
                                                                        SHA-512:39E6B104271AB13DCE1FE67E712CC9F6CE43A2A174CC3BE9ED879B3BAE1123289114E130CA81823BB5FF4DCD7FF9CE2441FEFAC7D95B4F3DB3136C78D2FF8480
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf....U..o.dm.#.WA}.|#.4z.6...T8=&.....r..2T.hdq.9..O..-.+.Npz.D.i....`...|...J;0.J.W.g.V*..)Ag...I.r......d.]/.V ....J....L.UQ.\?J.G..#....I.|.+....../L+b.]... .np...o....exA...<6...v...~...........$SvR.9B.{...=......7'.Cs7.4..ca.4...E.pe....:.,.=..,..N..(.9.k...;.:C....W..j....r.:&N..A..c`...4.r. C......a........}V.2..<..o...9.n*.I..h.Ky.....[.....)b....p.R.#`"In.....-#..W{.h.?[..$.(....S.. .6.P...^...%..._.<...J.\...u...}..i.F....LGv...Bf......$mR85`..R1....[..M5...._^....c.$.....JO...X....\J.7...4q.....r..^..Y.gQ..)f...~" ..X4...;...V.E/......qJ~..p8....N.....L..P.6.m*y..8.-.....%... .B\~..................3N.M....:j^1j..,0N.w..x.............!..Ne.!...v..~.#7;.,..\...!.D.?....<..+._vV!.\..` .....j:....M.....-=.$.a......8..u.%a.7x.J......Rf[......b..1.lR..N8...._kZ...j.............v.mR..2......C.!../.jp....m.lN)~..V.{.>.F.4...K+.^\....N.:.&/..u"s......V..S.|1x.C.*F..i/..E...y.y...0Q.=...C.............NS..j.X.k.._k(2......E..f.....J;.NC..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1045\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):90158
                                                                        Entropy (8bit):7.998007497187376
                                                                        Encrypted:true
                                                                        SSDEEP:1536:VCN/Dg+7LEi+Yf76uikFaH8NPY+C48cIKlBL6YuagF1tqS2aG7qtmop2JaLFDhBz:VMDgmLEKFacNPY+GjKjL6YRItqra8q7n
                                                                        MD5:DA780DC37354F59B6515274DB32152AE
                                                                        SHA1:32C1BF09D276D3BD88C31292557937269B3C841A
                                                                        SHA-256:2CC089EE495EF3D9B653B54BA178DA7CFE38E58708352E98A50BDFA123281905
                                                                        SHA-512:BBE3B9D9BDD5CEE767654C0E317F454D51A0A9D5595101B54718E8AE0B9515175F4895A4DD052E14CDFD728DB52F74BC07B44011F440133B8C0B4BB187DD8DA5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?....\.....Th.d...^.......Z..V|......].JH.. ....?......#..j. ....@P;.......+..H6.V..`...M..I..D.:.^A7.x.....6B.f(..S....J.G.....,.n../......Ps..t.(:...C.....m_...J.M....S.2.,....ja=16.?8.V......w.,.e.G&.....pgQQ.`).d.|..).dSw.U..........>.E....be......y..H#.e.........q.=..K..........Z...d..R.5..M..b.Z.1<...I.....7...1Z...p.n.......UI.5......jUO..:kQ|n-n.......]..........=...)3*...y-.K.0..6..V.6...5^.=Gp.;..;?$$.1=QI>.....>T....t.sZ..L.Ls..f.....c?....5:......y..1.a(.X...Z".~b/....|1~...E.`O..?.X.j..%zko.{o.A...I...^.O...'..HY..Z2..k.8{|.>...l...-..O,m. ...o....H....x..4..^.....N...cX...g...R...(*7...B.....W....M|....<.|..<....p.....q9.n.t.}._......B.N.<..j%...}2...p...]-.z..*..F...P.@.g...C....X.^...%&.b.Cl...)=.l2.. ...X.7.r...2Z....LMF....(..q..U.Iy<.....U.].#,...Ew.....K.x...*>r...:.>*'..s.V.....f.j...e...{^+j'.=*..dc..............#.......xB.M...5..S.d...wZ... ...x.......3.=!...7N&e..J.7..9"pX....s!c{Q...Hl.q.g@...rD...m.nl

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1045\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):90158
                                                                        Entropy (8bit):7.998007497187376
                                                                        Encrypted:true
                                                                        SSDEEP:1536:VCN/Dg+7LEi+Yf76uikFaH8NPY+C48cIKlBL6YuagF1tqS2aG7qtmop2JaLFDhBz:VMDgmLEKFacNPY+GjKjL6YRItqra8q7n
                                                                        MD5:DA780DC37354F59B6515274DB32152AE
                                                                        SHA1:32C1BF09D276D3BD88C31292557937269B3C841A
                                                                        SHA-256:2CC089EE495EF3D9B653B54BA178DA7CFE38E58708352E98A50BDFA123281905
                                                                        SHA-512:BBE3B9D9BDD5CEE767654C0E317F454D51A0A9D5595101B54718E8AE0B9515175F4895A4DD052E14CDFD728DB52F74BC07B44011F440133B8C0B4BB187DD8DA5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?....\.....Th.d...^.......Z..V|......].JH.. ....?......#..j. ....@P;.......+..H6.V..`...M..I..D.:.^A7.x.....6B.f(..S....J.G.....,.n../......Ps..t.(:...C.....m_...J.M....S.2.,....ja=16.?8.V......w.,.e.G&.....pgQQ.`).d.|..).dSw.U..........>.E....be......y..H#.e.........q.=..K..........Z...d..R.5..M..b.Z.1<...I.....7...1Z...p.n.......UI.5......jUO..:kQ|n-n.......]..........=...)3*...y-.K.0..6..V.6...5^.=Gp.;..;?$$.1=QI>.....>T....t.sZ..L.Ls..f.....c?....5:......y..1.a(.X...Z".~b/....|1~...E.`O..?.X.j..%zko.{o.A...I...^.O...'..HY..Z2..k.8{|.>...l...-..O,m. ...o....H....x..4..^.....N...cX...g...R...(*7...B.....W....M|....<.|..<....p.....q9.n.t.}._......B.N.<..j%...}2...p...]-.z..*..F...P.@.g...C....X.^...%&.b.Cl...)=.l2.. ...X.7.r...2Z....LMF....(..q..U.Iy<.....U.].#,...Ew.....K.x...*>r...:.>*'..s.V.....f.j...e...{^+j'.=*..dc..............#.......xB.M...5..S.d...wZ... ...x.......3.=!...7N&e..J.7..9"pX....s!c{Q...Hl.q.g@...rD...m.nl

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1045\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1045\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \351
                                                                        Category:dropped
                                                                        Size (bytes):7929
                                                                        Entropy (8bit):7.979035590692112
                                                                        Encrypted:false
                                                                        SSDEEP:192:/FN6yFWG5Wyl1C1wDQHEiXB9XIc66mOZv9kaIFuWsRYs:/FN6ymWM1wckje9VWsR3
                                                                        MD5:ABE3024E76D59E07108985BAE3DB3FFB
                                                                        SHA1:F707D418487A693DE571219C6F693E9BEFC2478A
                                                                        SHA-256:C526D40422FE208D96CD7FFA4CDC960E4886E057C005A1F839D3CC3DEAB6BB28
                                                                        SHA-512:9FCBBBC5E2B4C496DB57C6FF075BB7E4FA9257BDB05F5FDACFDBF6321F28A892D7E776F692D09D440E1874956B0437465050F259C50156D2CF15B02CD78B3416
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.....]..+..?....U.!.<...-w..j./}7..Q`..|..Q..En....T....a.7Y;..P.....q*C./8.@lK........~........"c6O....bj.G...:..-i~.C..6..\$.C=..#..8F..L.Ts8e..k...".7w.+....6 ..X.e...E?.u..%...:.8!.c.d.fE@...."'.. .0.{............0[....>b.....'......e.@...M.(..3r8N....................FM...N?..O..:x.V....ml.. ....RIa..=..NA l.&.,..c.|k.|..h_#/|....7f*..G...pw5.p$ g..&.....J...:..0.hG..L...4.=.q.b..L..B.W.....b....X....7x..!..!:Y........]..|,7.|.H.M....Q.OX...C..,}....0../..`....On.x..i.3TX.R=.X..?.... .....6...31...D6gb..I.-..?X..h....^=..J.....-.......%J..-]^M..#.+.M..bQS...;.....\ZITY%.!kx-P...aZ.7.k1&w....@.m.....t0:T...A.f...#NA.g.J="...n..`.>..*.Z;s..<8.I...G.W..X].._UR.0ti....7....,......rq...^.+#.|..Bw|..@..I......f..i.[S.bx....f.d.. ..+...8Cf...K=H.4e.....3......I.,r]...i..N.h}..U.e.3.._.Q.s.u.MUc.yT.....L.V._......{.......u..Yh.[9...z..e..L..tRa.].P..@v.....3.=.E..k.H.H.?.j.....V.D...!.mY.|.BO..m..^....-..p...Z;@bw.E.AC.........$..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1045\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \351
                                                                        Category:dropped
                                                                        Size (bytes):7929
                                                                        Entropy (8bit):7.979035590692112
                                                                        Encrypted:false
                                                                        SSDEEP:192:/FN6yFWG5Wyl1C1wDQHEiXB9XIc66mOZv9kaIFuWsRYs:/FN6ymWM1wckje9VWsR3
                                                                        MD5:ABE3024E76D59E07108985BAE3DB3FFB
                                                                        SHA1:F707D418487A693DE571219C6F693E9BEFC2478A
                                                                        SHA-256:C526D40422FE208D96CD7FFA4CDC960E4886E057C005A1F839D3CC3DEAB6BB28
                                                                        SHA-512:9FCBBBC5E2B4C496DB57C6FF075BB7E4FA9257BDB05F5FDACFDBF6321F28A892D7E776F692D09D440E1874956B0437465050F259C50156D2CF15B02CD78B3416
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.....]..+..?....U.!.<...-w..j./}7..Q`..|..Q..En....T....a.7Y;..P.....q*C./8.@lK........~........"c6O....bj.G...:..-i~.C..6..\$.C=..#..8F..L.Ts8e..k...".7w.+....6 ..X.e...E?.u..%...:.8!.c.d.fE@...."'.. .0.{............0[....>b.....'......e.@...M.(..3r8N....................FM...N?..O..:x.V....ml.. ....RIa..=..NA l.&.,..c.|k.|..h_#/|....7f*..G...pw5.p$ g..&.....J...:..0.hG..L...4.=.q.b..L..B.W.....b....X....7x..!..!:Y........]..|,7.|.H.M....Q.OX...C..,}....0../..`....On.x..i.3TX.R=.X..?.... .....6...31...D6gb..I.-..?X..h....^=..J.....-.......%J..-]^M..#.+.M..bQS...;.....\ZITY%.!kx-P...aZ.7.k1&w....@.m.....t0:T...A.f...#NA.g.J="...n..`.>..*.Z;s..<8.I...G.W..X].._UR.0ti....7....,......rq...^.+#.|..Bw|..@..I......f..i.[S.bx....f.d.. ..+...8Cf...K=H.4e.....3......I.,r]...i..N.h}..U.e.3.._.Q.s.u.MUc.yT.....L.V._......{.......u..Yh.[9...z..e..L..tRa.].P..@v.....3.=.E..k.H.H.?.j.....V.D...!.mY.|.BO..m..^....-..p...Z;@bw.E.AC.........$..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1046\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87018
                                                                        Entropy (8bit):7.9977590538874095
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ASw8se6Mt/bRypHHpkbUra1GTCTfBBOKyZ3XCeRBCU0zcKkDl/OXO6lGCH:1sqNbyuby3TIJE72NzTql/l6lGCH
                                                                        MD5:969A6D7443639CA546C2093075DF10F1
                                                                        SHA1:8A4DB58E0918B748012678E8B5DAC96B65484700
                                                                        SHA-256:5B99ACC277ACECA7C56B5C696FE99C901E8F372456825FAE2728FB12CB1CA002
                                                                        SHA-512:6E26C22D1E0492A0F8F7511DC16BFAB0B5A1B4B52DFB6CEEB5CBF054CF52B569231BCB306F0FB7E587FC06594C42E11AF7DE7D360D7375821DDD30428D011EB8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...0.|..~....yW...!46<..}.io.5.?a..Q..)..4.J.iLq!M....V...._....Q.+...F.N.l,X... :..q.ir......[...q.].C@....%....A...*...tJ.).P..0..Jd.....<>.m7[.~!....,.@...S|l...S-]q.I...c.s.....Y.dD./....{..=.-..F)=5."..E.7.....6..GYZ.)E$.q.X..d.n.y#.3w...j...Y..wDa:Q..4)^....[.........O..B....IB...g....E1Z~.U'....6F.?4..q.....'i.....8\....4.#..g....?1......-.E....I(....nm.-k...K........+SV.t..&...[..K>Q.&._Q..f$n.....B..QK;..+.p.YH...}....I...4v.....Ar..1nu.....w&.ec..jjg....wS..R....>..~fI....e!{f.c.4~@&....rw...C...K..Y.......R....I./D..{=.?.H/....h.-.tt..w..?.6.K.........|..Y...x hlhi.Q...._....=...P.$...|..,..AX!>i...@....y..........Qf...-G..^..:..AN`b$bR3..RG.3.....c4..R._!ll.YA..2..h.F..y.[......5X:2.#9.vi.0.|x|.......T......26..nB.-..u"..I.....sx....u.....{I...Y.ctG4.......:-2;.N....@c.ls...d C=J.$.../....kw...[.z..bw....`%...e..Y..;..H..7.D.nB4}......2.C.Q....<?b(i.G.y....hN..j9BWr.u..c3...H........M.W.`.]n.Q...;c1.*gC.....g......v.d\..'.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1046\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87018
                                                                        Entropy (8bit):7.9977590538874095
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ASw8se6Mt/bRypHHpkbUra1GTCTfBBOKyZ3XCeRBCU0zcKkDl/OXO6lGCH:1sqNbyuby3TIJE72NzTql/l6lGCH
                                                                        MD5:969A6D7443639CA546C2093075DF10F1
                                                                        SHA1:8A4DB58E0918B748012678E8B5DAC96B65484700
                                                                        SHA-256:5B99ACC277ACECA7C56B5C696FE99C901E8F372456825FAE2728FB12CB1CA002
                                                                        SHA-512:6E26C22D1E0492A0F8F7511DC16BFAB0B5A1B4B52DFB6CEEB5CBF054CF52B569231BCB306F0FB7E587FC06594C42E11AF7DE7D360D7375821DDD30428D011EB8
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...0.|..~....yW...!46<..}.io.5.?a..Q..)..4.J.iLq!M....V...._....Q.+...F.N.l,X... :..q.ir......[...q.].C@....%....A...*...tJ.).P..0..Jd.....<>.m7[.~!....,.@...S|l...S-]q.I...c.s.....Y.dD./....{..=.-..F)=5."..E.7.....6..GYZ.)E$.q.X..d.n.y#.3w...j...Y..wDa:Q..4)^....[.........O..B....IB...g....E1Z~.U'....6F.?4..q.....'i.....8\....4.#..g....?1......-.E....I(....nm.-k...K........+SV.t..&...[..K>Q.&._Q..f$n.....B..QK;..+.p.YH...}....I...4v.....Ar..1nu.....w&.ec..jjg....wS..R....>..~fI....e!{f.c.4~@&....rw...C...K..Y.......R....I./D..{=.?.H/....h.-.tt..w..?.6.K.........|..Y...x hlhi.Q...._....=...P.$...|..,..AX!>i...@....y..........Qf...-G..^..:..AN`b$bR3..RG.3.....c4..R._!ll.YA..2..h.F..y.[......5X:2.#9.vi.0.|x|.......T......26..nB.-..u"..I.....sx....u.....{I...Y.ctG4.......:-2;.N....@c.ls...d C=J.$.../....kw...[.z..bw....`%...e..Y..;..H..7.D.nB4}......2.C.Q....<?b(i.G.y....hN..j9BWr.u..c3...H........M.W.`.]n.Q...;c1.*gC.....g......v.d\..'.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1046\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1046\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \236
                                                                        Category:dropped
                                                                        Size (bytes):6500
                                                                        Entropy (8bit):7.969014859461808
                                                                        Encrypted:false
                                                                        SSDEEP:96:svR0+nuNhsVff/ZiL1fXJBz2hGZMbH2FNl0+TQfihABrQIW0tAq1MA617H+g8ErW:svR0aU/J8GKH2FNHNAFQIWQMAY/rpoz
                                                                        MD5:3FC71A840861E1AD8DDDD61B1F5533B9
                                                                        SHA1:C1CBBFD7489341AA00D4E45462207B3B45EDAED6
                                                                        SHA-256:2E3E61726C19BF7ACF3D964D95BE05AAF7E4B4D14633CFBB83C9B9F23F5F0CE3
                                                                        SHA-512:16DDC0EEEA5558B299B4D6DB3AD82E4A6BDF484CAB07EFA87A9115770E6403CC84DF8334DAA2F5402918D0BADB71F75639BDF50D9602820144E031FC99C1EC06
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.8 ...Wx5.u.^q`...2"......[.Mp...Vd.e...[k<.m......~ZV%....... }4t..../.nD........5........O..F../.E....c..cbq8..#.3..o..Ro.e...x<._7.Z.+lD..\hn../zh.Y.c..U...j...]hp..vw..6...W..@.$...O3.r......7..R2%~..M......A}.'>&n...U....f'..n....^..S#.uU..{.....X.Q]Q...E..|qv.F..}...=.,S...bK....n3......PJ9.y.8/.A.~T.< A.....))Nb.l.&T.....U .n...).bY.0.&.k&s.`"-..].n..WE].0.P..)...G._.g.N*d..H..._....g..7.T..8H7.S..W.].;H...@.C..o."$g..x........I..r.$..!6].n.).2...".((....t.!...o.u.oX..._..;.-.1....A.l.s.).4.I..J.&{a.$.=Xl....Q.\l..L........#c..j....!....~..8..l......hv..m.M...c.....zT(..1.,..KQ.n..H.tE.5M5Yq...2.P........L.f...T.I..6....h..U..+l._*Pw...D..u..{d...?kTE.0.zG...h.>...ZNM.J....cJe..)b...EzGd.J{..5..4]...7...W...!..3.I......=.f.Y......D>((vZRpD$..K..O./N:1JI........?IZ...;3.$@x.#1p...GEPE\.@./..U..&..t....41..|.m.V...?...%..DkO*.,>Vy...9.a.+.|.....Z.#..-.)T7......;...c..{x\/^K....u....I......3.E...|6.t..}0....M..~..@.o..D.Rf,.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1046\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \236
                                                                        Category:dropped
                                                                        Size (bytes):6500
                                                                        Entropy (8bit):7.969014859461808
                                                                        Encrypted:false
                                                                        SSDEEP:96:svR0+nuNhsVff/ZiL1fXJBz2hGZMbH2FNl0+TQfihABrQIW0tAq1MA617H+g8ErW:svR0aU/J8GKH2FNHNAFQIWQMAY/rpoz
                                                                        MD5:3FC71A840861E1AD8DDDD61B1F5533B9
                                                                        SHA1:C1CBBFD7489341AA00D4E45462207B3B45EDAED6
                                                                        SHA-256:2E3E61726C19BF7ACF3D964D95BE05AAF7E4B4D14633CFBB83C9B9F23F5F0CE3
                                                                        SHA-512:16DDC0EEEA5558B299B4D6DB3AD82E4A6BDF484CAB07EFA87A9115770E6403CC84DF8334DAA2F5402918D0BADB71F75639BDF50D9602820144E031FC99C1EC06
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf.8 ...Wx5.u.^q`...2"......[.Mp...Vd.e...[k<.m......~ZV%....... }4t..../.nD........5........O..F../.E....c..cbq8..#.3..o..Ro.e...x<._7.Z.+lD..\hn../zh.Y.c..U...j...]hp..vw..6...W..@.$...O3.r......7..R2%~..M......A}.'>&n...U....f'..n....^..S#.uU..{.....X.Q]Q...E..|qv.F..}...=.,S...bK....n3......PJ9.y.8/.A.~T.< A.....))Nb.l.&T.....U .n...).bY.0.&.k&s.`"-..].n..WE].0.P..)...G._.g.N*d..H..._....g..7.T..8H7.S..W.].;H...@.C..o."$g..x........I..r.$..!6].n.).2...".((....t.!...o.u.oX..._..;.-.1....A.l.s.).4.I..J.&{a.$.=Xl....Q.\l..L........#c..j....!....~..8..l......hv..m.M...c.....zT(..1.,..KQ.n..H.tE.5M5Yq...2.P........L.f...T.I..6....h..U..+l._*Pw...D..u..{d...?kTE.0.zG...h.>...ZNM.J....cJe..)b...EzGd.J{..5..4]...7...W...!..3.I......=.f.Y......D>((vZRpD$..K..O./N:1JI........?IZ...;3.$@x.#1p...GEPE\.@./..U..&..t....41..|.m.V...?...%..DkO*.,>Vy...9.a.+.|.....Z.#..-.)T7......;...c..{x\/^K....u....I......3.E...|6.t..}0....M..~..@.o..D.Rf,.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1049\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88820
                                                                        Entropy (8bit):7.997542856229356
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ZSaIpi4NUxl+m3OG0dtjCclfCfoPXPHBPdYPy6laOBCVh3g/N4mLVyH3m:0g46Km32x/PZPdj6PghQV4mpyXm
                                                                        MD5:B66E25B7641D49CFF388562853227E2B
                                                                        SHA1:B9DD4CE8A546F85E450185FF82AF8B39056C5D30
                                                                        SHA-256:5C2BCD587F18698C91E30D3840E72951A6D544A70B29667EEEAADF918272497C
                                                                        SHA-512:23BA71C07087BA7B252989331B5A5A7B0C637B1B6784B13C9CF95CB3877E8EA88E9DBAF838010FA6274EC59F38AD64C7F3771243AC186F9EC78CE1B78366E242
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.....9......O!n".00T.+..d.(.r/7R]V..dG.A..^...K"#Mu.R..I......5..ma..4..h.WIx...^.....X.S..,.:g..].{..3K...v.t...V}zF..?.A.tD.F... %.9Kn1......v.T.....4.&..Q..nH...i......n.....M.'.v.....3O1....^I.k..}.,..}L.J.M.l......o*..%z..H9Q)GF.".>..Q....^..&.....2..._......;.7..'g.....}o...5r.T...n]K@..v.by/..S...23...u.=f..4FTU...{....+...0....H.E|@b.Wa..U.[R..).....Tt..l.....u..K.2.6....."s*..w...d...H...lY.b...t^.....$...|w.....%...e.So.......z9.:..&p....C/J..=r>"._.5.....c-mp9.X.~.q8......w.L.|...f...E.....fy....E..[.Mj.m}u.{..".Gh}q......U.+`*/I..t...........Yk.w`.V?Y.Jk.......X..J.^B..e>.#A..E.?-....foSh..!..@..M...........I.;I.Cm..p...J..]...y;.......HU...)...e.g)...F.C..s...\.e!...J..R..u...f...n;.?.=...$9.}"ti[B.|7D, ..\.L48J..L-}&..E4.x...C..>7f.....i}"...`.()`.<...tI.3TXS.s$.2...D.B...j...m.SE.,;.....u....`..@<..].....\?k...H.j......3.h..<.[..nCr<.I~.~N.C..8.w[..O...\.......,v_.E..Xi6...m...q%p.,.B...2..6...$$,.w....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1049\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88820
                                                                        Entropy (8bit):7.997542856229356
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ZSaIpi4NUxl+m3OG0dtjCclfCfoPXPHBPdYPy6laOBCVh3g/N4mLVyH3m:0g46Km32x/PZPdj6PghQV4mpyXm
                                                                        MD5:B66E25B7641D49CFF388562853227E2B
                                                                        SHA1:B9DD4CE8A546F85E450185FF82AF8B39056C5D30
                                                                        SHA-256:5C2BCD587F18698C91E30D3840E72951A6D544A70B29667EEEAADF918272497C
                                                                        SHA-512:23BA71C07087BA7B252989331B5A5A7B0C637B1B6784B13C9CF95CB3877E8EA88E9DBAF838010FA6274EC59F38AD64C7F3771243AC186F9EC78CE1B78366E242
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.....9......O!n".00T.+..d.(.r/7R]V..dG.A..^...K"#Mu.R..I......5..ma..4..h.WIx...^.....X.S..,.:g..].{..3K...v.t...V}zF..?.A.tD.F... %.9Kn1......v.T.....4.&..Q..nH...i......n.....M.'.v.....3O1....^I.k..}.,..}L.J.M.l......o*..%z..H9Q)GF.".>..Q....^..&.....2..._......;.7..'g.....}o...5r.T...n]K@..v.by/..S...23...u.=f..4FTU...{....+...0....H.E|@b.Wa..U.[R..).....Tt..l.....u..K.2.6....."s*..w...d...H...lY.b...t^.....$...|w.....%...e.So.......z9.:..&p....C/J..=r>"._.5.....c-mp9.X.~.q8......w.L.|...f...E.....fy....E..[.Mj.m}u.{..".Gh}q......U.+`*/I..t...........Yk.w`.V?Y.Jk.......X..J.^B..e>.#A..E.?-....foSh..!..@..M...........I.;I.Cm..p...J..]...y;.......HU...)...e.g)...F.C..s...\.e!...J..R..u...f...n;.?.=...$9.}"ti[B.|7D, ..\.L48J..L-}&..E4.x...C..>7f.....i}"...`.()`.<...tI.3TXS.s$.2...D.B...j...m.SE.,;.....u....`..@<..].....\?k...H.j......3.h..<.[..nCr<.I~.~N.C..8.w[..O...\.......,v_.E..Xi6...m...q%p.,.B...2..6...$$,.w....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1049\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1049\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \212
                                                                        Category:dropped
                                                                        Size (bytes):18211
                                                                        Entropy (8bit):7.990769196242836
                                                                        Encrypted:true
                                                                        SSDEEP:384:mC2FWjU1k7u2zAbCkfT/CE4oUVREx7bqN/5m2KqP6KJzV:8l1IgqosG6/m2p68V
                                                                        MD5:3445BB01C37F8C0C228004E6F596A797
                                                                        SHA1:1A17957D41F1E517430F4F5DD5B5CA11859D8DE1
                                                                        SHA-256:DA9B6D0D5A290632F1139AEDB4939C12C966D2AC0F625FF5461A5BBA8EC2D6B7
                                                                        SHA-512:E6164C1CF6D67DB290003815B0D34935D70E9A06C493D039DB9D749D97DBC31584933BDA3E615C01C9AD86ED358B5A5A58C687B50A3172191C415A97FD494487
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:{\rtf.un..9..4.gz.&.....^u#.........V...mY.....1.uUH.!....3{..}....O.#..3.b.B. .5%........$....|.....2.3.H......C}.ibP.TLO..~B.Y.......:.^.|P......3...3.........<.F..K.....r.:..6Q..e.].....s..Y.......O..+...C_;..D.....o..9......1..... k..Y7..;Q..o.0uA.K...Z.K.nq..\b.......F.8.G..)YA;...s.7..f..R......G.....k...@.Q.f.;...k^SG.."=.a$T.l..M$...f<... ....[..B.....:|qcr...|56.......8.G....%)8..ICm.f#....o..8....4{.}...^;.v.....C.7..Q."...U\i..&7jnyq.|.A...#.@..H.x...!.$W.e.....9.:..V 91.]........Va.J....g-...*I~...[....U...+.~f.....n...v..C.1*..o6.OV#..7.w..j...$...?/.P@8.VA#..;...N'.q.....x7X...yx.]..L..-.'......y..|.?=.k...gB|\..k...6x..).P.(. ..<s.....[......I3...n.d....j.".q.1DTj.F.R-....C.^02.I...A!o.z...H.......;...9...i.u..f....|..$O...p.nf.....^...-..py"..G\.(.....^......R.%)..?.....z.X.dX.....b$.%.59._....#...R0.N...9.,_.Gw.N.....].:..Qx....n...h..J.z....jh_....&*6}Y.o...d%.......t.P..[.........M..Nh...K3......~>.6..:..0*.......[..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1049\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \212
                                                                        Category:dropped
                                                                        Size (bytes):18211
                                                                        Entropy (8bit):7.990769196242836
                                                                        Encrypted:true
                                                                        SSDEEP:384:mC2FWjU1k7u2zAbCkfT/CE4oUVREx7bqN/5m2KqP6KJzV:8l1IgqosG6/m2p68V
                                                                        MD5:3445BB01C37F8C0C228004E6F596A797
                                                                        SHA1:1A17957D41F1E517430F4F5DD5B5CA11859D8DE1
                                                                        SHA-256:DA9B6D0D5A290632F1139AEDB4939C12C966D2AC0F625FF5461A5BBA8EC2D6B7
                                                                        SHA-512:E6164C1CF6D67DB290003815B0D34935D70E9A06C493D039DB9D749D97DBC31584933BDA3E615C01C9AD86ED358B5A5A58C687B50A3172191C415A97FD494487
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:{\rtf.un..9..4.gz.&.....^u#.........V...mY.....1.uUH.!....3{..}....O.#..3.b.B. .5%........$....|.....2.3.H......C}.ibP.TLO..~B.Y.......:.^.|P......3...3.........<.F..K.....r.:..6Q..e.].....s..Y.......O..+...C_;..D.....o..9......1..... k..Y7..;Q..o.0uA.K...Z.K.nq..\b.......F.8.G..)YA;...s.7..f..R......G.....k...@.Q.f.;...k^SG.."=.a$T.l..M$...f<... ....[..B.....:|qcr...|56.......8.G....%)8..ICm.f#....o..8....4{.}...^;.v.....C.7..Q."...U\i..&7jnyq.|.A...#.@..H.x...!.$W.e.....9.:..V 91.]........Va.J....g-...*I~...[....U...+.~f.....n...v..C.1*..o6.OV#..7.w..j...$...?/.P@8.VA#..;...N'.q.....x7X...yx.]..L..-.'......y..|.?=.k...gB|\..k...6x..).P.(. ..<s.....[......I3...n.d....j.".q.1DTj.F.R-....C.^02.I...A!o.z...H.......;...9...i.u..f....|..$O...p.nf.....^...-..py"..G\.(.....^......R.%)..?.....z.X.dX.....b$.%.59._....#...R0.N...9.,_.Gw.N.....].:..Qx....n...h..J.z....jh_....&*6}Y.o...d%.......t.P..[.........M..Nh...K3......~>.6..:..0*.......[..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1053\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85944
                                                                        Entropy (8bit):7.997862323609847
                                                                        Encrypted:true
                                                                        SSDEEP:1536:xGi7p2kLFZAQ+R5K3nNRlu51mZw0p1t1e4fAVb7FqNlMrc/svfndWc:xGAzAn6o51me0p/c4fAclcc/QdWc
                                                                        MD5:BD4544F0E77F4A279CF068EBD20D1FCE
                                                                        SHA1:DA8786D68AF22DF682D374169BF09A21213DBFDC
                                                                        SHA-256:6F2377D8762A7B914EB1A7A9B9A59C323A838962CF429B43D2CBA3FF35E7C85A
                                                                        SHA-512:09AA0AC27D289A5FAD177FA46EE0E7B3128B6B9D7EDE89853AA202ADDFD50D72170826FBA810604A32083D1F8E8F5E0A187083B8A7EF5FF65BD6320638715687
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...j..Bp.7V..R...I"!.O]..4.......(..~?.hf{[.{.}.$.y..SJp.....E..>..<..Q.@.1.VJ...l.....*_E...G.2.jZiS..A.A...{o....*..;g_9...:?....5.k.&...*..c..c8}.P.#../p+...s.w.[f.e.-..'.|..n..M.. ......&..o..O.H..hZM..V.Mi.O3)..v....).26.@..~2..7x.c.q....e....f7'.#.C.*..!.G.7...R.....2.Q..;._.}!..'.....8..D.."YP0_..&vN.Sm..vj\%.bB..,...J..0v.....iki.Hn#Z.Uw.._.....A`j...4......_..M..\8J9.^.@.VE@./........T....#.c-.2...J..+.....S.5..:K..,<|.m...`.....P..".:..~u.m..Ve....{[.'.J...B.0.r&..FO0.T.V...s..AU....@.Oh.-L../..`.......a@*.T.W0{R..~............S..I%..}.!...G..7..@..~F>IO<..a..4..r_...@.5.i.....4.}M_...:.B..d3v.......S.C&k.a....1.;./.[.......7n.R}.....+k...lk......4..ckD.'5.D,....J!2.7..B.Y.n.O.e...\tC.L..Dz......=F..]d..6vvM.....7.o...*=......"w....l.'..sV....JQ8...es...'...".E.Nr.....&...!..&:a...'.r5.O..I6PnI.PO.c...'..%t6gv...d...l.05.?3....,....#...G....}/.......|.(..j.....Z........1...avEjH..H'.i.q..z.5..-Y.....S=....^.u.....d..\.........

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1053\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85944
                                                                        Entropy (8bit):7.997862323609847
                                                                        Encrypted:true
                                                                        SSDEEP:1536:xGi7p2kLFZAQ+R5K3nNRlu51mZw0p1t1e4fAVb7FqNlMrc/svfndWc:xGAzAn6o51me0p/c4fAclcc/QdWc
                                                                        MD5:BD4544F0E77F4A279CF068EBD20D1FCE
                                                                        SHA1:DA8786D68AF22DF682D374169BF09A21213DBFDC
                                                                        SHA-256:6F2377D8762A7B914EB1A7A9B9A59C323A838962CF429B43D2CBA3FF35E7C85A
                                                                        SHA-512:09AA0AC27D289A5FAD177FA46EE0E7B3128B6B9D7EDE89853AA202ADDFD50D72170826FBA810604A32083D1F8E8F5E0A187083B8A7EF5FF65BD6320638715687
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...j..Bp.7V..R...I"!.O]..4.......(..~?.hf{[.{.}.$.y..SJp.....E..>..<..Q.@.1.VJ...l.....*_E...G.2.jZiS..A.A...{o....*..;g_9...:?....5.k.&...*..c..c8}.P.#../p+...s.w.[f.e.-..'.|..n..M.. ......&..o..O.H..hZM..V.Mi.O3)..v....).26.@..~2..7x.c.q....e....f7'.#.C.*..!.G.7...R.....2.Q..;._.}!..'.....8..D.."YP0_..&vN.Sm..vj\%.bB..,...J..0v.....iki.Hn#Z.Uw.._.....A`j...4......_..M..\8J9.^.@.VE@./........T....#.c-.2...J..+.....S.5..:K..,<|.m...`.....P..".:..~u.m..Ve....{[.'.J...B.0.r&..FO0.T.V...s..AU....@.Oh.-L../..`.......a@*.T.W0{R..~............S..I%..}.!...G..7..@..~F>IO<..a..4..r_...@.5.i.....4.}M_...:.B..d3v.......S.C&k.a....1.;./.[.......7n.R}.....+k...lk......4..ckD.'5.D,....J!2.7..B.Y.n.O.e...\tC.L..Dz......=F..]d..6vvM.....7.o...*=......"w....l.'..sV....JQ8...es...'...".E.Nr.....&...!..&:a...'.r5.O..I6PnI.PO.c...'..%t6gv...d...l.05.?3....,....#...G....}/.......|.(..j.....Z........1...avEjH..H'.i.q..z.5..-Y.....S=....^.u.....d..\.........

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1053\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1053\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version (
                                                                        Category:dropped
                                                                        Size (bytes):6079
                                                                        Entropy (8bit):7.965972906086949
                                                                        Encrypted:false
                                                                        SSDEEP:96:g7DrkAUWNOnYaInP3k48cVe84kcJomephJpRegj6E9ObvWC4/sCbpKycjwP9Y0x:+DrLU+OY9nR8cEecJojphAgWMOr6kCbn
                                                                        MD5:53C688108E08765342089B449B05D8C2
                                                                        SHA1:8D7C2132A97B95ACDD23F6EE834072034D1D0D29
                                                                        SHA-256:D230B34D9E23A22F6A948E868C074EF78AEE3C50EEE33AB8F4CE07E0A7927C1A
                                                                        SHA-512:CC4AF7B1FD7FC51363D2AE6493FE3889AAF74F2CA025AAA604891950A4A04A8A6798AD7CEC16C2D865054D5A6981958801C23057F9779415290A48A67E40FE00
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf(..'..W.'...i.2..._..7../..C.......U...{.H..L.......S6l.Da..9Vl.}Q.Kq.......J.T..s....O...|s.&a...eT...5.7<.w..r....y2..Zd.... +&r.d%...._.....M.c....R\.:.AyC.........../..6kc..l%'AwK.C\...r......Dc..8...u....C..."'.....]_\...[.....f........h....#..#4.g\.c....=..|....%.q.N.n..#....`._...q...2.....z.b..b.9.q;Q.|..`..`.. .....y;..b..'......0_..8z....fh..) R..Mz..-8.q.p..........>c.2....<..t..+..Q...u.{.L...V..W.qQi...n..tWH.@4U!:wA.=I.....8.A.~..Rq.q....-..."......_..s...7..^ Lu.._*-....P*....6...M.;,..!ZE&..}&Nk.Y~....4...1...{..."....'.,..4...Q.........?.@1j.....UW..JbXQ...{<... .......j.z....=....=....=...:t.]..z..f.~.2.!G....t..1A.oi@...w7.....OT..|G..Th;.....a......{}Q..........U.D.V...Ey......l.t..;...w./..L-0.U......*C...@.;\...m.-....S..V...+..V..."...s..c..p.&.rk.# E...q.R*...;.....vf..S/K..g........uk....4.T?.-..3ZM6.......O$I.fU...>h6....E..]mC...s.Xo.s4..LY./.F.6.a...M..!.gR.^....'....F`!.D_...x.^.-|.CDl.m../.r..8D

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1053\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version (
                                                                        Category:dropped
                                                                        Size (bytes):6079
                                                                        Entropy (8bit):7.965972906086949
                                                                        Encrypted:false
                                                                        SSDEEP:96:g7DrkAUWNOnYaInP3k48cVe84kcJomephJpRegj6E9ObvWC4/sCbpKycjwP9Y0x:+DrLU+OY9nR8cEecJojphAgWMOr6kCbn
                                                                        MD5:53C688108E08765342089B449B05D8C2
                                                                        SHA1:8D7C2132A97B95ACDD23F6EE834072034D1D0D29
                                                                        SHA-256:D230B34D9E23A22F6A948E868C074EF78AEE3C50EEE33AB8F4CE07E0A7927C1A
                                                                        SHA-512:CC4AF7B1FD7FC51363D2AE6493FE3889AAF74F2CA025AAA604891950A4A04A8A6798AD7CEC16C2D865054D5A6981958801C23057F9779415290A48A67E40FE00
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf(..'..W.'...i.2..._..7../..C.......U...{.H..L.......S6l.Da..9Vl.}Q.Kq.......J.T..s....O...|s.&a...eT...5.7<.w..r....y2..Zd.... +&r.d%...._.....M.c....R\.:.AyC.........../..6kc..l%'AwK.C\...r......Dc..8...u....C..."'.....]_\...[.....f........h....#..#4.g\.c....=..|....%.q.N.n..#....`._...q...2.....z.b..b.9.q;Q.|..`..`.. .....y;..b..'......0_..8z....fh..) R..Mz..-8.q.p..........>c.2....<..t..+..Q...u.{.L...V..W.qQi...n..tWH.@4U!:wA.=I.....8.A.~..Rq.q....-..."......_..s...7..^ Lu.._*-....P*....6...M.;,..!ZE&..}&Nk.Y~....4...1...{..."....'.,..4...Q.........?.@1j.....UW..JbXQ...{<... .......j.z....=....=....=...:t.]..z..f.~.2.!G....t..1A.oi@...w7.....OT..|G..Th;.....a......{}Q..........U.D.V...Ey......l.t..;...w./..L-0.U......*C...@.;\...m.-....S..V...+..V..."...s..c..p.&.rk.# E...q.R*...;.....vf..S/K..g........uk....4.T?.-..3ZM6.......O$I.fU...>h6....E..]mC...s.Xo.s4..LY./.F.6.a...M..!.gR.^....'....F`!.D_...x.^.-|.CDl.m../.r..8D

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1055\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85898
                                                                        Entropy (8bit):7.997826427873926
                                                                        Encrypted:true
                                                                        SSDEEP:1536:m1zBCzd/t+DpsgCQShLafH6HiAxbC7qqIlVhB5i9tttqaq50GYsd:mBBCzSq5aPMiAxbC7VUhBotIgGHd
                                                                        MD5:55C3544DB735A74C1D35B1D778926E70
                                                                        SHA1:3196A27F694A43AEC8CACA7205EE5F6808C4EA17
                                                                        SHA-256:A53BF4F2897B794CB766B7E826D61B4A8480D2A2563B3FBF9955AA6AA7A16893
                                                                        SHA-512:88835E3313C02EF0C07FC1F6B68218242B946CDDFFB19781B3C467B6DD44EF6C1DC9436A52F61B32B451A16C0D003E36BB6061657903C6E56A2C1AB24AE95924
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.0\.W..0\....k.......]5.....}.&Q...\g=.L.ne._..@..../>..u.f..R%.u]T.v.].a. ~.......P../..{.....N.&..........i}..pz..*.....i0q...,....].`..B...%....K.......~.[j`.na......h.......K......:...&.hQ...k.).'.q.......[.B...-5..\.P...j.eG=s.0.4.\s.%".Fh...2,.i.......o.Y.)r.9..A1TL:.^..t..%...^.*.y#.;a.6.K.C.=..:..b.7.s...s..AdeD...O$.oJh]...C.Q.`,.76PQ+.~<.F`.... .........U.?.s.lF0!...[.?..)N.:.S.k.!D.....~yy..@..^.v.U..c......^...g..Ew.~m...d......UZz...N.2..sQ.R.Y..v....-...2....d.OF.Q.o.0w../...8..i.r...z.A....S.vee.W_.IB..$...;j.v.......UX&....:..-B..7..Ak..Bb.F..*'.....jdh.\....... .)_Wv...F.L...<p.^d.!.B..qS..uw=...d?W.. Gd...:G.S..+r^s.cB+..C. M..g..'T]....u..wLc.Hq.zU9.I{/....:...:..A..W;....R.. ...n.....`.L....^1..N....h:...r.RN.n.qK...Yk.Y.m.x.h....a'K.F.}..Dw.P.`.i.4.2.$...G.v..~.C..-.t.=...*.(l...,.3.[".&'C.+&P..x!.l....m..t.=.....Iv.q.My.^.%.03.\M.....;..>....xF.....?....Q.....>...x.-Da.......JE. 6...uJ.,$.M....m..."/.z..;.g

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1055\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):85898
                                                                        Entropy (8bit):7.997826427873926
                                                                        Encrypted:true
                                                                        SSDEEP:1536:m1zBCzd/t+DpsgCQShLafH6HiAxbC7qqIlVhB5i9tttqaq50GYsd:mBBCzSq5aPMiAxbC7VUhBotIgGHd
                                                                        MD5:55C3544DB735A74C1D35B1D778926E70
                                                                        SHA1:3196A27F694A43AEC8CACA7205EE5F6808C4EA17
                                                                        SHA-256:A53BF4F2897B794CB766B7E826D61B4A8480D2A2563B3FBF9955AA6AA7A16893
                                                                        SHA-512:88835E3313C02EF0C07FC1F6B68218242B946CDDFFB19781B3C467B6DD44EF6C1DC9436A52F61B32B451A16C0D003E36BB6061657903C6E56A2C1AB24AE95924
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.0\.W..0\....k.......]5.....}.&Q...\g=.L.ne._..@..../>..u.f..R%.u]T.v.].a. ~.......P../..{.....N.&..........i}..pz..*.....i0q...,....].`..B...%....K.......~.[j`.na......h.......K......:...&.hQ...k.).'.q.......[.B...-5..\.P...j.eG=s.0.4.\s.%".Fh...2,.i.......o.Y.)r.9..A1TL:.^..t..%...^.*.y#.;a.6.K.C.=..:..b.7.s...s..AdeD...O$.oJh]...C.Q.`,.76PQ+.~<.F`.... .........U.?.s.lF0!...[.?..)N.:.S.k.!D.....~yy..@..^.v.U..c......^...g..Ew.~m...d......UZz...N.2..sQ.R.Y..v....-...2....d.OF.Q.o.0w../...8..i.r...z.A....S.vee.W_.IB..$...;j.v.......UX&....:..-B..7..Ak..Bb.F..*'.....jdh.\....... .)_Wv...F.L...<p.^d.!.B..qS..uw=...d?W.. Gd...:G.S..+r^s.cB+..C. M..g..'T]....u..wLc.Hq.zU9.I{/....:...:..A..W;....R.. ...n.....`.L....^1..N....h:...r.RN.n.qK...Yk.Y.m.x.h....a'K.F.}..Dw.P.`.i.4.2.$...G.v..~.C..-.t.=...*.(l...,.3.[".&'C.+&P..x!.l....m..t.=.....Iv.q.My.^.%.03.\M.....;..>....xF.....?....Q.....>...x.-Da.......JE. 6...uJ.,$.M....m..."/.z..;.g

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1055\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1055\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version G
                                                                        Category:dropped
                                                                        Size (bytes):8423
                                                                        Entropy (8bit):7.976944596999406
                                                                        Encrypted:false
                                                                        SSDEEP:192:PHdA9FBMlCAgeBwxpPKsG6SaVUOGR1rCTjBJkhd5ssBV:f2/ocxpCviVaPaG7xBV
                                                                        MD5:C0E8B6F7A99836BC14B09D3CF31D377D
                                                                        SHA1:8235C212B2B0D24617C932108A2CCD3DDF107DE9
                                                                        SHA-256:089BAC11DF1F5661052A0C1D14CA8DBC0B9AD5A7FC7B9318D57FB4BDD4D2AD79
                                                                        SHA-512:5040F30A7A2774B71FCD1A7DC41941A7924A93C6ED060CC87E7DF440B780D2415AD2414A60B77CEBF48C2F3E1B1D767BA50532871EF2FF8E9FFD6BEF13AD51F4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfG....;D....i.Cmh..46....3..[DA.1$<N...NS.U....y.................m....0.....p....K..Z..........w..............T....x{9.f............-..........3...\\..8...W...9.L.8.Mb....\..... .}.<P....A....7..U.L6./c.~1a.\"B...m.Z.k..b.(R..*..&...E..}}..=..E.._Aak...A..^_..g.l.{..y..%5 .u(.{L.~...%>.Rx.7...:#...:...\..^.J...."nx..o.n.._I.."..\'d.Um_~eSZh.h........l.T..v.)..V.t>...... ib... .. .h.48a...U,f..n(M.(..`z>0...Y.C-....g....g.@.....W...t,...0..LP...R...U.?hz.DQ$.....8.-....J.....2>...)....\~o..W......$..s7.o6.,o.9.W...r.]J.......1..~M. %"#..u5..'...p.T...$.b\.i...DV....@+..NFjqxN}....`..!...|p..5..M.UAx#.e:y...L<N.P.....}.....[....^.?J.>.U........K.w.u.V./#^.R......,..D!..-A.G.....Z..E&.v.:..#...K...X.WAC+.j.}.<k.T.....`J..H.......e.a.k{A${;..$f..k..[.v..m%.'.fQx.....h0L...R5a.C....D.."RTz^.....y......P.8e...J.N]...-.e.../.........P...S.m..}Sv....8.....!.4...X.....2@..-..y...Y..._c.).)}.)..e.4f..b.?-..P.......+.............',..I....fN..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\1055\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version G
                                                                        Category:dropped
                                                                        Size (bytes):8423
                                                                        Entropy (8bit):7.976944596999406
                                                                        Encrypted:false
                                                                        SSDEEP:192:PHdA9FBMlCAgeBwxpPKsG6SaVUOGR1rCTjBJkhd5ssBV:f2/ocxpCviVaPaG7xBV
                                                                        MD5:C0E8B6F7A99836BC14B09D3CF31D377D
                                                                        SHA1:8235C212B2B0D24617C932108A2CCD3DDF107DE9
                                                                        SHA-256:089BAC11DF1F5661052A0C1D14CA8DBC0B9AD5A7FC7B9318D57FB4BDD4D2AD79
                                                                        SHA-512:5040F30A7A2774B71FCD1A7DC41941A7924A93C6ED060CC87E7DF440B780D2415AD2414A60B77CEBF48C2F3E1B1D767BA50532871EF2FF8E9FFD6BEF13AD51F4
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfG....;D....i.Cmh..46....3..[DA.1$<N...NS.U....y.................m....0.....p....K..Z..........w..............T....x{9.f............-..........3...\\..8...W...9.L.8.Mb....\..... .}.<P....A....7..U.L6./c.~1a.\"B...m.Z.k..b.(R..*..&...E..}}..=..E.._Aak...A..^_..g.l.{..y..%5 .u(.{L.~...%>.Rx.7...:#...:...\..^.J...."nx..o.n.._I.."..\'d.Um_~eSZh.h........l.T..v.)..V.t>...... ib... .. .h.48a...U,f..n(M.(..`z>0...Y.C-....g....g.@.....W...t,...0..LP...R...U.?hz.DQ$.....8.-....J.....2>...)....\~o..W......$..s7.o6.,o.9.W...r.]J.......1..~M. %"#..u5..'...p.T...$.b\.i...DV....@+..NFjqxN}....`..!...|p..5..M.UAx#.e:y...L<N.P.....}.....[....^.?J.>.U........K.w.u.V./#^.R......,..D!..-A.G.....Z..E&.v.:..#...K...X.WAC+.j.}.<k.T.....`J..H.......e.a.k{A${;..$f..k..[.v..m%.'.fQx.....h0L...R5a.C....D.."RTz^.....y......P.8e...J.N]...-.e.../.........P...S.m..}Sv....8.....!.4...X.....2@..-..y...Y..._c.).)}.)..e.4f..b.?-..P.......+.............',..I....fN..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2052\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):71234
                                                                        Entropy (8bit):7.997331310696444
                                                                        Encrypted:true
                                                                        SSDEEP:1536:p8Cx9xdum9ErJcvRPLb004IFkYJ1aUScO0sfYlX0Sv1+:mCx9PumG6zHFku1ZSV9bSI
                                                                        MD5:03F8CE86DCF12FF6E91DF2856CB0378A
                                                                        SHA1:9B854A2265B6E2EB5B91D2AD121F5A9E93DB8E03
                                                                        SHA-256:7FF727999829741C9B3515BAFE00B8E1FCE4771FECFF60099289F77CE471FA76
                                                                        SHA-512:29A598014B4D5F2F55A37B720D705F3A57DC2656875D07FDEC8C1E49312E3C8F9B526A2EAF7360AD15BD41D7AA48F8B3AEA3A6EE2BB8A28AD1B920DCCF39422F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..,...9.9rM....En.i...,.......Tc...Pl....=.........ZTx.@_%zo.x. ...O...(...4.......*......9F....&m..X.=UJd.....8...ug2._a...V7. ..O..#E.....K...(d(.q]...3{%Q.......J../u.....UD..,@_.}.i..]..W4....T.f..E0XZ..x...\.A,(.....E......g......".FP.\..U.p....:.....yU.&.....x..X1....s3..).,d..>.B./{`Vo.....H.*...........r...N...?......|.]..}.....~.Dr_...T:...MgZ.pj...e.z_...({I...Q.w2.|.3k.|..w.\..7.).5'..{._.0...)z..H.<+Q..A.Zk..7R..]..N[..h-...k..).L~...U.\}P......."D.D...Ab..].....Mq.B...qb.9j.*7.mbUj...s!x5.[Nj.p.%7..D+dZf.&.'k.>Dv+..\........\.f...bv..J3....n..o..V.q.e..u...h..&xr..h..uN|...|.X....;1..z.*.........P(.....X:c.....-6$W6. `..m5,..'^.vT.M....$.Vup..C..>...F...Z.M.-C%.nm..MIJya .!...5.W...G...F.k.n5..nN.x.nE.....4.R..1...N.K....J.l2.t=b..W....+.I...bO.!...b.F..CW'.Q..[....$].....{.G.9.1.].)2....%.Y...'>..:...(r.......k......A/.HU.@.....}.nd...H.1..)...k7..Q1a.!._@{./".2....I....=k..0...eAi.".l....]2.{s.........3ns..m.... ..M/.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2052\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):71234
                                                                        Entropy (8bit):7.997331310696444
                                                                        Encrypted:true
                                                                        SSDEEP:1536:p8Cx9xdum9ErJcvRPLb004IFkYJ1aUScO0sfYlX0Sv1+:mCx9PumG6zHFku1ZSV9bSI
                                                                        MD5:03F8CE86DCF12FF6E91DF2856CB0378A
                                                                        SHA1:9B854A2265B6E2EB5B91D2AD121F5A9E93DB8E03
                                                                        SHA-256:7FF727999829741C9B3515BAFE00B8E1FCE4771FECFF60099289F77CE471FA76
                                                                        SHA-512:29A598014B4D5F2F55A37B720D705F3A57DC2656875D07FDEC8C1E49312E3C8F9B526A2EAF7360AD15BD41D7AA48F8B3AEA3A6EE2BB8A28AD1B920DCCF39422F
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..,...9.9rM....En.i...,.......Tc...Pl....=.........ZTx.@_%zo.x. ...O...(...4.......*......9F....&m..X.=UJd.....8...ug2._a...V7. ..O..#E.....K...(d(.q]...3{%Q.......J../u.....UD..,@_.}.i..]..W4....T.f..E0XZ..x...\.A,(.....E......g......".FP.\..U.p....:.....yU.&.....x..X1....s3..).,d..>.B./{`Vo.....H.*...........r...N...?......|.]..}.....~.Dr_...T:...MgZ.pj...e.z_...({I...Q.w2.|.3k.|..w.\..7.).5'..{._.0...)z..H.<+Q..A.Zk..7R..]..N[..h-...k..).L~...U.\}P......."D.D...Ab..].....Mq.B...qb.9j.*7.mbUj...s!x5.[Nj.p.%7..D+dZf.&.'k.>Dv+..\........\.f...bv..J3....n..o..V.q.e..u...h..&xr..h..uN|...|.X....;1..z.*.........P(.....X:c.....-6$W6. `..m5,..'^.vT.M....$.Vup..C..>...F...Z.M.-C%.nm..MIJya .!...5.W...G...F.k.n5..nN.x.nE.....4.R..1...N.K....J.l2.t=b..W....+.I...bO.!...b.F..CW'.Q..[....$].....{.G.9.1.].)2....%.Y...'>..:...(r.......k......A/.HU.@.....}.nd...H.1..)...k7..Q1a.!._@{./".2....I....=k..0...eAi.".l....]2.{s.........3ns..m.... ..M/.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2052\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2052\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version :
                                                                        Category:dropped
                                                                        Size (bytes):9960
                                                                        Entropy (8bit):7.981611152267424
                                                                        Encrypted:false
                                                                        SSDEEP:192:sDyOnh/UL4akHIHMpipSjKlbpndWgbm9wbQiKV/E9vPG2TpT/BT:sDyOnh/UMHIsUSjKlbpdDbm92TKRCXjj
                                                                        MD5:20A68B782E364503692E01D8347A0C52
                                                                        SHA1:CAF758DD99C97A1A24B9AD5D6B7315D7C68571F9
                                                                        SHA-256:4F888EF5AEC92B21B96D86DD3B18C1E2089EE348E265D59DEECA998782B70014
                                                                        SHA-512:63EFB878396C6A2B0C17FC5BC9B452F0AB702853202616C9D42AD3CAB1F1F023D6FFC5769D71C853B1CC5D2100C1CCAFD54F7245227B4F767F5C735F7D6A7CD1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf:..D5.i...T...H.......@.>i........&..r..*..J....M)..Zl H..G....,tt.qt..:a.....b.. b..j."..v..........C.h...V...hP.azn.$.8.5...qs.....=<..-..w...T..Z.....>V...|.. .T;....r&..!....K{....Q...,.......Q.g.a5...4.9.....B.W..`..........%0..K..<..*....B...[x.m..)...6...=.;.......[i.3}Q.q.T....:^...j.....=,.j.-i=p.>*..p.%.....VG9|ml.O............n..-..D.C..bY.Fw/l..GG..:....G-.8.]+`...L...u..1....dN.y.../*0.3juWi..FyV...6...f.U..w.rP...="...O....>.#b.fm...;....v...C....F."V..=.z..#..ks6..O.*..6.-,.*...u...7`y.....S.....M..g.WZf5...-.........m.a5.%3.....G.^..6..r..../r....=."..%.@(..WFa....._.fx.0e........_........&....NE.`.#..M|...6|9.<..AVa4i..A..IH..m.Iu.t...bS:..I.%@.Y.....v...X..e]x..T?...{...E.S.gc.3ej..H.E...l/e...*.9...Q......E'...Z..G..H.M.,%.APE..H...6..:^...#.Qww)...o...a....U&...H..._zLfi....9y........1.....R.].c../.uj6.Q....P.>...L......a.Q....i=....p5..R1.S.<.}...j..B(..G..t...C..p.%.- ....Q.W.BSL@.l....#.]...#.... .......Q

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2052\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version :
                                                                        Category:dropped
                                                                        Size (bytes):9960
                                                                        Entropy (8bit):7.981611152267424
                                                                        Encrypted:false
                                                                        SSDEEP:192:sDyOnh/UL4akHIHMpipSjKlbpndWgbm9wbQiKV/E9vPG2TpT/BT:sDyOnh/UMHIsUSjKlbpdDbm92TKRCXjj
                                                                        MD5:20A68B782E364503692E01D8347A0C52
                                                                        SHA1:CAF758DD99C97A1A24B9AD5D6B7315D7C68571F9
                                                                        SHA-256:4F888EF5AEC92B21B96D86DD3B18C1E2089EE348E265D59DEECA998782B70014
                                                                        SHA-512:63EFB878396C6A2B0C17FC5BC9B452F0AB702853202616C9D42AD3CAB1F1F023D6FFC5769D71C853B1CC5D2100C1CCAFD54F7245227B4F767F5C735F7D6A7CD1
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf:..D5.i...T...H.......@.>i........&..r..*..J....M)..Zl H..G....,tt.qt..:a.....b.. b..j."..v..........C.h...V...hP.azn.$.8.5...qs.....=<..-..w...T..Z.....>V...|.. .T;....r&..!....K{....Q...,.......Q.g.a5...4.9.....B.W..`..........%0..K..<..*....B...[x.m..)...6...=.;.......[i.3}Q.q.T....:^...j.....=,.j.-i=p.>*..p.%.....VG9|ml.O............n..-..D.C..bY.Fw/l..GG..:....G-.8.]+`...L...u..1....dN.y.../*0.3juWi..FyV...6...f.U..w.rP...="...O....>.#b.fm...;....v...C....F."V..=.z..#..ks6..O.*..6.-,.*...u...7`y.....S.....M..g.WZf5...-.........m.a5.%3.....G.^..6..r..../r....=."..%.@(..WFa....._.fx.0e........_........&....NE.`.#..M|...6|9.<..AVa4i..A..IH..m.Iu.t...bS:..I.%@.Y.....v...X..e]x..T?...{...E.S.gc.3ej..H.E...l/e...*.9...Q......E'...Z..G..H.M.,%.APE..H...6..:^...#.Qww)...o...a....U&...H..._zLfi....9y........1.....R.].c../.uj6.Q....P.>...L......a.Q....i=....p5..R1.S.<.}...j..B(..G..t...C..p.%.- ....Q.W.BSL@.l....#.]...#.... .......Q

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2070\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88722
                                                                        Entropy (8bit):7.997816233419982
                                                                        Encrypted:true
                                                                        SSDEEP:1536:DorpHi4BxpeAkd9OFClNz0cEDl77jajt2cvJit1Q1q9BxhthEuQ2TO5:DoHBxpo9GCPz0xl78I1QY9BxhthEuQiE
                                                                        MD5:AC4B261B7D2DD5A07E47F9D05FFC6D45
                                                                        SHA1:D8DF38B03390C39B9310A05F9828B68B0E6ADDC0
                                                                        SHA-256:20E8C1E67CE50FDE99F1696E9DD1CE57983CE94E0B7AAA4159702758EEC24AF1
                                                                        SHA-512:178B92C68A1D12C2A51A9025982D8ECBDBE6CB6A1073701BB715C8EC62B4495C30EFEAD563029D957DE1C1D586CA87743A8E0B9A6E6CF858DECC5D5B4EB20C0A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.c.;..W..*.j.....l...n.q....5.ky.NX7.....]...Q.8.......K-..0..A......R%...nBR8j.sP....J.4...o.Q....'s+....9..].1.?.`.....!Pd..Q..z2..^wY......"k..?.hvM..I.(.Q9-7...?.........{Q....8..Nb.I......XZ....+.Pw;%...PaR.F..i..|.;n..."+.....<a...!qz...$.......v..hu..H..l)..*......_.d$.V@.t..Hb.v..*r..\.....=..;.I>P.A.%..gd},.6....br......m...=R...O.G0.T...^.......>]+..p.....9...Y..36.W..Y...GsD..@Y.2..5...W.K.6.h`.>.........j.=.2..iJ.0*........W0y.V.&.05.b`.r.l9.9X.T...........W..Z..a..O..sY...G..).jr:~.x.+..4./.}:.2..\...\\.O....6..q..A+n..}/.*,...ie.WB...v.@.Ome&9.F;1...#..q-...,d.....7wL...\..J...rLR<1..8%d.0......~..F...}....[h.0..!.>.A.\^.l.x.}.......L.YB.H.Y..J_2..}@.[.".Iw...e-;....m...R..a.7.2...5..\.=..B..W.Sn.>J.1r_4...b...}...N.'@g<..........]..4.......k.Sh^...B..T...]l.......HX..2......~.....J..#.c..G/$....-...lT...C........1......C..K'.b.G..~..P.M".v^...,.ih...3..&;Z.9Cp..e2.....v.G.}.+..y.x..iN..76....?X`J.>....xa{...d...#.i..O......|

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2070\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88722
                                                                        Entropy (8bit):7.997816233419982
                                                                        Encrypted:true
                                                                        SSDEEP:1536:DorpHi4BxpeAkd9OFClNz0cEDl77jajt2cvJit1Q1q9BxhthEuQ2TO5:DoHBxpo9GCPz0xl78I1QY9BxhthEuQiE
                                                                        MD5:AC4B261B7D2DD5A07E47F9D05FFC6D45
                                                                        SHA1:D8DF38B03390C39B9310A05F9828B68B0E6ADDC0
                                                                        SHA-256:20E8C1E67CE50FDE99F1696E9DD1CE57983CE94E0B7AAA4159702758EEC24AF1
                                                                        SHA-512:178B92C68A1D12C2A51A9025982D8ECBDBE6CB6A1073701BB715C8EC62B4495C30EFEAD563029D957DE1C1D586CA87743A8E0B9A6E6CF858DECC5D5B4EB20C0A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?.c.;..W..*.j.....l...n.q....5.ky.NX7.....]...Q.8.......K-..0..A......R%...nBR8j.sP....J.4...o.Q....'s+....9..].1.?.`.....!Pd..Q..z2..^wY......"k..?.hvM..I.(.Q9-7...?.........{Q....8..Nb.I......XZ....+.Pw;%...PaR.F..i..|.;n..."+.....<a...!qz...$.......v..hu..H..l)..*......_.d$.V@.t..Hb.v..*r..\.....=..;.I>P.A.%..gd},.6....br......m...=R...O.G0.T...^.......>]+..p.....9...Y..36.W..Y...GsD..@Y.2..5...W.K.6.h`.>.........j.=.2..iJ.0*........W0y.V.&.05.b`.r.l9.9X.T...........W..Z..a..O..sY...G..).jr:~.x.+..4./.}:.2..\...\\.O....6..q..A+n..}/.*,...ie.WB...v.@.Ome&9.F;1...#..q-...,d.....7wL...\..J...rLR<1..8%d.0......~..F...}....[h.0..!.>.A.\^.l.x.}.......L.YB.H.Y..J_2..}@.[.".Iw...e-;....m...R..a.7.2...5..\.=..B..W.Sn.>J.1r_4...b...}...N.'@g<..........]..4.......k.Sh^...B..T...]l.......HX..2......~.....J..#.c..G/$....-...lT...C........1......C..K'.b.G..~..P.M".v^...,.ih...3..&;Z.9Cp..e2.....v.G.}.+..y.x..iN..76....?X`J.>....xa{...d...#.i..O......|

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2070\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2070\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \313
                                                                        Category:dropped
                                                                        Size (bytes):6618
                                                                        Entropy (8bit):7.970333914122584
                                                                        Encrypted:false
                                                                        SSDEEP:192:nIgFDyk7ozhxxAVA1jYjMMHus7Bs6Zb7WazceREBvdd:IXA+hKA1s9uKS0KNd
                                                                        MD5:AF29CA1FE0DE8A878A7350313A4C290B
                                                                        SHA1:3AB0EC8959D59DD0A8000358ABB2983AAF1DA073
                                                                        SHA-256:579398B6DACABE3D210643E1DCF946FA3D7D7F41654BD4C9FEE99D92C28070DD
                                                                        SHA-512:9E0BCF5F536F5009DD0B22D05034A86EF906DBF114F578C5108A073E3703175366DA0CE6DA016DFEB2DC31D98EF4F9875090A74F1DDE1BD4ED9F73CF567588D6
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf....(.....Gam&.h....K.v..J.=.1:..e..=#.UW.Fi6....`.(/.i.Dn..g..t.O...MR<.rbm.y.......o........A.....$......-w..%P=...pU?..}3f'..Y.u..[...k...Ho....{.@.7..9.\..N..M...W.........0u..W...\.M.pE.X.....<...<..e.`4..O...7.<....ua.%.$.!..}..3.>I..p..4....Q.....o.?.)......0?mb../r...5%hT..H.......s.KX..y$...h#.H..J....g...J......w...O..3.g...d..q?..Y.yw.:..W..3>x...a ..8...8(.aT..,.z.w...N.{.*b,.!/fw@..{r....y....B..n>..d...4K..70.#.....}U&...Z....a..c....i...=.d..z.....2....0..6z..l..}d+Kv.l.\.U..l.5....(.....heA..........^..@.3.^4.7..0!IH2N.9L.YB...g3.i.g2.&L....i)F............._ +.....>.nK....7H.7.....`.&..:5Y~j#)...wQ......j.Yqk.E.q.xZ...'.%...g6.;Fm$.j..:.O.K.$........6..cX..B..b............1"wg*m.oY...N.../3.....lU..Ajh2.........1;....-.paCg...=N`..V.&....N.9..F...q.*Y.7........(W.(..S?...k ./Y..3.?..M...m4.,}.6.=S.W.._)nI.<...*E.4.!....8......x.?.....#...Dzp....&5........(:..S"Z..%70..8....3...d..=.c...h.u..IC|...Ng..GX.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\2070\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version \313
                                                                        Category:dropped
                                                                        Size (bytes):6618
                                                                        Entropy (8bit):7.970333914122584
                                                                        Encrypted:false
                                                                        SSDEEP:192:nIgFDyk7ozhxxAVA1jYjMMHus7Bs6Zb7WazceREBvdd:IXA+hKA1s9uKS0KNd
                                                                        MD5:AF29CA1FE0DE8A878A7350313A4C290B
                                                                        SHA1:3AB0EC8959D59DD0A8000358ABB2983AAF1DA073
                                                                        SHA-256:579398B6DACABE3D210643E1DCF946FA3D7D7F41654BD4C9FEE99D92C28070DD
                                                                        SHA-512:9E0BCF5F536F5009DD0B22D05034A86EF906DBF114F578C5108A073E3703175366DA0CE6DA016DFEB2DC31D98EF4F9875090A74F1DDE1BD4ED9F73CF567588D6
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtf....(.....Gam&.h....K.v..J.=.1:..e..=#.UW.Fi6....`.(/.i.Dn..g..t.O...MR<.rbm.y.......o........A.....$......-w..%P=...pU?..}3f'..Y.u..[...k...Ho....{.@.7..9.\..N..M...W.........0u..W...\.M.pE.X.....<...<..e.`4..O...7.<....ua.%.$.!..}..3.>I..p..4....Q.....o.?.)......0?mb../r...5%hT..H.......s.KX..y$...h#.H..J....g...J......w...O..3.g...d..q?..Y.yw.:..W..3>x...a ..8...8(.aT..,.z.w...N.{.*b,.!/fw@..{r....y....B..n>..d...4K..70.#.....}U&...Z....a..c....i...=.d..z.....2....0..6z..l..}d+Kv.l.\.U..l.5....(.....heA..........^..@.3.^4.7..0!IH2N.9L.YB...g3.i.g2.&L....i)F............._ +.....>.nK....7H.7.....`.&..:5Y~j#)...wQ......j.Yqk.E.q.xZ...'.%...g6.;Fm$.j..:.O.K.$........6..cX..B..b............1"wg*m.oY...N.../3.....lU..Ajh2.........1;....-.paCg...=N`..V.&....N.9..F...q.*Y.7........(W.(..S?...k ./Y..3.?..M...m4.,}.6.=S.W.._)nI.<...*E.4.!....8......x.?.....#...Dzp....&5........(:..S"Z..%70..8....3...d..=.c...h.u..IC|...Ng..GX.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\3082\LocalizedData.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87996
                                                                        Entropy (8bit):7.9979148405261125
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ZbHvedW/ch5sfr356qmBHbW+XPOmlkBhbxHK25a5CA3lVaTr27n1/:ZbPgW0vsfr356JHnXP7QHKGa5CDrC1/
                                                                        MD5:D5E2CDFA2CF31E2A7B466ECF3AD085B7
                                                                        SHA1:BA170EF2FF89541C37ACA20FA127C46312B72EC6
                                                                        SHA-256:1E53566DFDDF07A5FA5619454E98395AF6DD098C1E87578C65FA40510CF3E330
                                                                        SHA-512:5C335BA6FF9526A5B92E886D9E2579ADA08007CB60F43DDEAD6C0FD80F8B9C78632E097AD4C94362FC17C899D7591EF68CA2A3C6C5924DA3B4B82496286D3CB7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...J...p...<...B.H.ZiC.s..F.R....:C.....8....}......Hf....;.U...Pi.MD.r.P......K..L...3....=..#e.H0.I..........3.1.....laQ..].. .tW<.8.IP..w#.-1".?...vJ.....!.R\..0...3.~....qK.K|b.J.....>bG-36.t$_W..&rLe.....Cf........$qb....+.......E.ec.i.<.!.A.P.X8.......9....V.x.[.?..HT.D.....D`..r...GP.......E>...C]..M...b.....^.U.Z........y!T>.]..FvM..=...u k..NV#....9B...m.[........3...~.....(...l..N...-...~.]1...H..5.z.;3...X...u.L.$...^.k.v..;.X..1_O.2#@Vfo.>...C.....U.A+.#.{z.8{'J...]..I... ....&..O....S......XCP...Q....$FH.xlP.U*hN.U9...5..y9e.A..k.1.5y....P.M.d5..A/Ze.v"...%F..R.....5..Y.....c-...F[..../.....yW*0....;A';....^.b.......7.......-y.$..Q..N...E.'...?eT..I...#J?3....a...k....t.W..........7..].2&.Fsz)w....r~.CR.L.y..."..e..$%..:.<....wa.;..Z.Xz.J.&..n.!....^..2.3 ....'...l....Y.t....=../4.3w.[..y.5...R..jI27.d......uF..{........E..........=F..@......a.WW+lWu..4^..d.=es.=..xX3..#i.%..t....nS..9...:/."E...8.[./..W.k}.66.M

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\3082\LocalizedData.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):87996
                                                                        Entropy (8bit):7.9979148405261125
                                                                        Encrypted:true
                                                                        SSDEEP:1536:ZbHvedW/ch5sfr356qmBHbW+XPOmlkBhbxHK25a5CA3lVaTr27n1/:ZbPgW0vsfr356JHnXP7QHKGa5CDrC1/
                                                                        MD5:D5E2CDFA2CF31E2A7B466ECF3AD085B7
                                                                        SHA1:BA170EF2FF89541C37ACA20FA127C46312B72EC6
                                                                        SHA-256:1E53566DFDDF07A5FA5619454E98395AF6DD098C1E87578C65FA40510CF3E330
                                                                        SHA-512:5C335BA6FF9526A5B92E886D9E2579ADA08007CB60F43DDEAD6C0FD80F8B9C78632E097AD4C94362FC17C899D7591EF68CA2A3C6C5924DA3B4B82496286D3CB7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?...J...p...<...B.H.ZiC.s..F.R....:C.....8....}......Hf....;.U...Pi.MD.r.P......K..L...3....=..#e.H0.I..........3.1.....laQ..].. .tW<.8.IP..w#.-1".?...vJ.....!.R\..0...3.~....qK.K|b.J.....>bG-36.t$_W..&rLe.....Cf........$qb....+.......E.ec.i.<.!.A.P.X8.......9....V.x.[.?..HT.D.....D`..r...GP.......E>...C]..M...b.....^.U.Z........y!T>.]..FvM..=...u k..NV#....9B...m.[........3...~.....(...l..N...-...~.]1...H..5.z.;3...X...u.L.$...^.k.v..;.X..1_O.2#@Vfo.>...C.....U.A+.#.{z.8{'J...]..I... ....&..O....S......XCP...Q....$FH.xlP.U*hN.U9...5..y9e.A..k.1.5y....P.M.d5..A/Ze.v"...%F..R.....5..Y.....c-...F[..../.....yW*0....;A';....^.b.......7.......-y.$..Q..N...E.'...?eT..I...#J?3....a...k....t.W..........7..].2&.Fsz)w....r~.CR.L.y..."..e..$%..:.<....wa.;..Z.Xz.J.&..n.!....^..2.3 ....'...l....Y.t....=../4.3w.[..y.5...R..jI27.d......uF..{........E..........=F..@......a.WW+lWu..4^..d.=es.=..xX3..#i.%..t....nS..9...:/."E...8.[./..W.k}.66.M

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\3082\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\3082\eula.rtf

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version p
                                                                        Category:dropped
                                                                        Size (bytes):6448
                                                                        Entropy (8bit):7.9716230028950426
                                                                        Encrypted:false
                                                                        SSDEEP:192:sckU+HGXaiIS2ggWC75TV2hp9f8w94SkSRpG3cGkW:JkDHGwS26ONVi8wOeRAcGZ
                                                                        MD5:32F474A46572547788DDF1993AF188D3
                                                                        SHA1:09D410A60881AD82C325EF6B90E952AD5F4839C6
                                                                        SHA-256:E43DDD17733F325A71507FF02E490497D7CEA19030F21A8B3073FFB4FB3855CD
                                                                        SHA-512:78884D0926A64ACCAA1A248935BF16AF81733127D64F369FD994758849FCDB41951C07EBF692093B533F0244935EDE03F21F7B1775DB0AE1D9C64452483F8324
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfp~m..GG.`B...'v.t.....s....@.Ok.N.I.!..1u_....t.,.G.Z..(.......GF5cH4Qv...P.Vq.q.;.^..O...%9s...mZ..e.{.v....Y..T..J..C.#...0.?...Jkin.>.kY.K.H{.h."M....v...V.%W@..g4...x.j*...c.....?...<.C_.v...e.3...!&..zD.o {1a.v}....R....O....C.....+.Q.L}uAiT.*&.V..H..z.A.U.b.x..&...z[.>.h..b.Y.".......J.k{.-.+._..^..l.6O.]CqS.....q.^.`j3QB./\+.....8..c....m0.......B...a.9.l.....-.>....:..3.d..|p...T./.5.v......(,c....#B."Q.w.F..e..48..E..!.............p...+.{.z:....d.'......g..6..siR..W...K7^..A2f..9..:.O.V..w.?....D.)..t...M.;..8....H.f.9......J.#...OXG.J.....xh...l..d.v..3@...*I)......d.H.:....a.S.L.;...n.Hc........X G....S..E1....c.F.'E.>...`.:.H*.x.Z.....J._.v.!.r.{G...|e.m..5...._jv...D>a.6.EW..`9.&...2_.-..B...!.kC.u..'E..l>..c.;J.s..Vd...A..qc..-'.3...."...l....b....Z.........).d.....Pg..J>.eJ....:$W.N8..g......v...L|O.`9v~5k.wO.b.'.t.U..9........./.<.~.%.T...=..L.y.......hu..<..1p.i...Z.r.x....z..n.<.@..roQ....S...l.yr.....].F3<2=

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\3082\eula.rtf.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:Rich Text Format data, version p
                                                                        Category:dropped
                                                                        Size (bytes):6448
                                                                        Entropy (8bit):7.9716230028950426
                                                                        Encrypted:false
                                                                        SSDEEP:192:sckU+HGXaiIS2ggWC75TV2hp9f8w94SkSRpG3cGkW:JkDHGwS26ONVi8wOeRAcGZ
                                                                        MD5:32F474A46572547788DDF1993AF188D3
                                                                        SHA1:09D410A60881AD82C325EF6B90E952AD5F4839C6
                                                                        SHA-256:E43DDD17733F325A71507FF02E490497D7CEA19030F21A8B3073FFB4FB3855CD
                                                                        SHA-512:78884D0926A64ACCAA1A248935BF16AF81733127D64F369FD994758849FCDB41951C07EBF692093B533F0244935EDE03F21F7B1775DB0AE1D9C64452483F8324
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:{\rtfp~m..GG.`B...'v.t.....s....@.Ok.N.I.!..1u_....t.,.G.Z..(.......GF5cH4Qv...P.Vq.q.;.^..O...%9s...mZ..e.{.v....Y..T..J..C.#...0.?...Jkin.>.kY.K.H{.h."M....v...V.%W@..g4...x.j*...c.....?...<.C_.v...e.3...!&..zD.o {1a.v}....R....O....C.....+.Q.L}uAiT.*&.V..H..z.A.U.b.x..&...z[.>.h..b.Y.".......J.k{.-.+._..^..l.6O.]CqS.....q.^.`j3QB./\+.....8..c....m0.......B...a.9.l.....-.>....:..3.d..|p...T./.5.v......(,c....#B."Q.w.F..e..48..E..!.............p...+.{.z:....d.'......g..6..siR..W...K7^..A2f..9..:.O.V..w.?....D.)..t...M.;..8....H.f.9......J.#...OXG.J.....xh...l..d.v..3@...*I)......d.H.:....a.S.L.;...n.Hc........X G....S..E1....c.F.'E.>...`.:.H*.x.Z.....J._.v.!.r.{G...|e.m..5...._jv...D>a.6.EW..`9.&...2_.-..B...!.kC.u..'E..l>..c.;J.s..Vd...A..qc..-'.3...."...l....b....Z.........).d.....Pg..J>.eJ....:$W.N8..g......v...L|O.`9v~5k.wO.b.'.t.U..9........./.<.~.%.T...=..L.y.......hu..<..1p.i...Z.r.x....z..n.<.@..roQ....S...l.yr.....].F3<2=

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\DHtmlHeader.html

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):16452
                                                                        Entropy (8bit):7.988651928016251
                                                                        Encrypted:false
                                                                        SSDEEP:384:v0B+yIbePxUg3Klk8dQ+gFXox4Hsx4NRmdr/sYcuz:1QPf2SFX6mRQr/Vc8
                                                                        MD5:6F7F3B02730FFF44B5A488ACC72543A6
                                                                        SHA1:EF14BFB1B26D9ECB077CEB9D9845B0101EBABB84
                                                                        SHA-256:7E0CFF09084F85FAB25AB06E2628075B4D91EDBE0C461B639AC96857624E0BC8
                                                                        SHA-512:F37C45EE5C1CA93C172DD406A7018725468466E497956A08BC05C4C57D28AC86A54A27A9F8EC9609FE3BBC97C343E4D13EC50F994A8A4EAC46A3C2EB3FF6C9B9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:..<.!Z"........x2A....:......@2&.......P..<....8n.6u.x....G.?....)t....|....d.0..........-X...Z....e..T..{..( ..j..a......$.@.E&*c.).*.;.w?Z.%#arq......%...o."9..:.`,8........p/Y..FE.n..S...%.....a....l.Lg.Q{...v.....f.\f....?....m.#B;8n.".h.7..-t.O3Cw.......c._...........9.c..1.e6.A....G/.\..mh.....g".*M.N.q.9.a.{M.G=........l.....H.x..)..0k.i.......r..E&.H...M.w..X.cs5.R..(zQ6G..@..}.5..;.l..4.....L..'E.......,T.MP.....-T.Gxd....Jv......6.Fv....Ae.+...i.%D?[.E81....i U.....Q30.n.;......r.x?..f.%..TU...R..%.)+.|..4......N..A\./M..8.;.+..Q..dO.m\....../Ru...Y....u.....U..-..fa.P....I.X..zL5Yv....MD..)&...7.G....0[z.3G.F.8?.).?.T_}..P...*..>.j..A.]sy.&~...bY...A.....#..o...h{*}.S.rw.....Lv?.g..E..6w..>D.=.Ryx?..!.p.wn.{....O....Fzg...9...._0.t.jY.0.?x%..."."....w.......{./.....&....S...3...........<J.d...b>..Q.?.....S.o..U..5.K?..M....>.r.!.q...."...D.t.Z6>.$......Y#.B.,..Y._........$.5...qKl>.*...s|...[.....O.m.c!X.#4...N.l....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\DHtmlHeader.html.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):16452
                                                                        Entropy (8bit):7.988651928016251
                                                                        Encrypted:false
                                                                        SSDEEP:384:v0B+yIbePxUg3Klk8dQ+gFXox4Hsx4NRmdr/sYcuz:1QPf2SFX6mRQr/Vc8
                                                                        MD5:6F7F3B02730FFF44B5A488ACC72543A6
                                                                        SHA1:EF14BFB1B26D9ECB077CEB9D9845B0101EBABB84
                                                                        SHA-256:7E0CFF09084F85FAB25AB06E2628075B4D91EDBE0C461B639AC96857624E0BC8
                                                                        SHA-512:F37C45EE5C1CA93C172DD406A7018725468466E497956A08BC05C4C57D28AC86A54A27A9F8EC9609FE3BBC97C343E4D13EC50F994A8A4EAC46A3C2EB3FF6C9B9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:..<.!Z"........x2A....:......@2&.......P..<....8n.6u.x....G.?....)t....|....d.0..........-X...Z....e..T..{..( ..j..a......$.@.E&*c.).*.;.w?Z.%#arq......%...o."9..:.`,8........p/Y..FE.n..S...%.....a....l.Lg.Q{...v.....f.\f....?....m.#B;8n.".h.7..-t.O3Cw.......c._...........9.c..1.e6.A....G/.\..mh.....g".*M.N.q.9.a.{M.G=........l.....H.x..)..0k.i.......r..E&.H...M.w..X.cs5.R..(zQ6G..@..}.5..;.l..4.....L..'E.......,T.MP.....-T.Gxd....Jv......6.Fv....Ae.+...i.%D?[.E81....i U.....Q30.n.;......r.x?..f.%..TU...R..%.)+.|..4......N..A\./M..8.;.+..Q..dO.m\....../Ru...Y....u.....U..-..fa.P....I.X..zL5Yv....MD..)&...7.G....0[z.3G.F.8?.).?.T_}..P...*..>.j..A.]sy.&~...bY...A.....#..o...h{*}.S.rw.....Lv?.g..E..6w..>D.=.Ryx?..!.p.wn.{....O....Fzg...9...._0.t.jY.0.?x%..."."....w.......{./.....&....S...3...........<J.d...b>..Q.?.....S.o..U..5.K?..M....>.r.!.q...."...D.t.Z6>.$......Y#.B.,..Y._........$.5...qKl>.*...s|...[.....O.m.c!X.#4...N.l....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\DisplayIcon.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88867
                                                                        Entropy (8bit):7.9976216107342015
                                                                        Encrypted:true
                                                                        SSDEEP:1536:6eaH7LHdIDDXP9Mu62l0EE2t9nsmuDuEo5Z/rEVJTY+6NftC0q2:7VX1V90wnn8uEN7TpiK2
                                                                        MD5:8E915287A4432B9D6BCF1BFA71315924
                                                                        SHA1:3BD70BF6A30F76141BA2AE91F3523F9A1A42DB58
                                                                        SHA-256:7126D59C9FE78CB0CE23F9171C3C23F5C5C3092A6DEFA8C49222F15C248EDE94
                                                                        SHA-512:2EA91081506CD6B7E35C30C6DABA32D05D9B96CBA4EB9FBF152F969E5A84002B6544C1F25798BAA147D0AECA258F87EA70F91E727E6731B2286A8DB6EF0B9759
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:........$b...........;..>w....z.M...........:.`.`u..g....u..d...B*4q7.`.....v..:........[e...$K,.P..X.H...\'U.._5..>b7.1.....@..y.rf..0.N..@b#........5..~7...?.....-......#.._.. Ko..{.m%..m~.).M.&...CP.S..:{q....C..uW.6.L..Y........~id.:M.2.C.>A..p.c .t.C....0;.\.......B8.`LL..o...Pr........3V..Z.\.../.|&....#6l...H2..*....%.(.2.7.2..T..)...?..?.,E..q.F.].{m...`g.t.3..N...b%x$...7..G.-....d"78ca....tu..-..N.1=..Z>9.k*..G.v{ND..P......X..y....o.0...^...=%....I. .3.@.1CY..5...?.C.DM9bQ.E...F.~..@..4.'z..._$...o.rJQ.}.._..J..n#o....._[..?....g.`+ja]....W./..a.n.^......rw....<.3.........$f.P.6.l..*.w..jxL}..iC..I.......B2..1.......3?2+8r.....3.W..Wr=.D..t.....d+y@...4.I........I.J....U~.....:..W....s,..u.....C;...S.^.Mw..(}.o...-.e<0.DS.p.<...@...V..!C.RYfT..-V.Yx....k.. ..+...>..K.Z....?W.;.T.O..0T.H...H.K.Y.F=....p.....-..R.p.OC.....l.836m...e.[..ga..&Y...)V........`J.m..MC......~BZ"..zQ.:..\4..2...cm6;.....0.r...].Hn..3|F.b......]0.@.n..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\DisplayIcon.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):88867
                                                                        Entropy (8bit):7.9976216107342015
                                                                        Encrypted:true
                                                                        SSDEEP:1536:6eaH7LHdIDDXP9Mu62l0EE2t9nsmuDuEo5Z/rEVJTY+6NftC0q2:7VX1V90wnn8uEN7TpiK2
                                                                        MD5:8E915287A4432B9D6BCF1BFA71315924
                                                                        SHA1:3BD70BF6A30F76141BA2AE91F3523F9A1A42DB58
                                                                        SHA-256:7126D59C9FE78CB0CE23F9171C3C23F5C5C3092A6DEFA8C49222F15C248EDE94
                                                                        SHA-512:2EA91081506CD6B7E35C30C6DABA32D05D9B96CBA4EB9FBF152F969E5A84002B6544C1F25798BAA147D0AECA258F87EA70F91E727E6731B2286A8DB6EF0B9759
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:........$b...........;..>w....z.M...........:.`.`u..g....u..d...B*4q7.`.....v..:........[e...$K,.P..X.H...\'U.._5..>b7.1.....@..y.rf..0.N..@b#........5..~7...?.....-......#.._.. Ko..{.m%..m~.).M.&...CP.S..:{q....C..uW.6.L..Y........~id.:M.2.C.>A..p.c .t.C....0;.\.......B8.`LL..o...Pr........3V..Z.\.../.|&....#6l...H2..*....%.(.2.7.2..T..)...?..?.,E..q.F.].{m...`g.t.3..N...b%x$...7..G.-....d"78ca....tu..-..N.1=..Z>9.k*..G.v{ND..P......X..y....o.0...^...=%....I. .3.@.1CY..5...?.C.DM9bQ.E...F.~..@..4.'z..._$...o.rJQ.}.._..J..n#o....._[..?....g.`+ja]....W./..a.n.^......rw....<.3.........$f.P.6.l..*.w..jxL}..iC..I.......B2..1.......3?2+8r.....3.W..Wr=.D..t.....d+y@...4.I........I.J....U~.....:..W....s,..u.....C;...S.^.Mw..(}.o...-.e<0.DS.p.<...@...V..!C.RYfT..-V.Yx....k.. ..+...>..K.Z....?W.;.T.O..0T.H...H.K.Y.F=....p.....-..R.p.OC.....l.836m...e.[..ga..&Y...)V........`J.m..MC......~BZ"..zQ.:..\4..2...cm6;.....0.r...].Hn..3|F.b......]0.@.n..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Print.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):126466
                                                                        Entropy (8bit):7.998519552063491
                                                                        Encrypted:true
                                                                        SSDEEP:3072:oFcBN80YxipTs8UywLIWILKBCaxjafL8MrqPN0LDN4d0:UcT809K3cfL825DNq0
                                                                        MD5:A7B788EBA7511284EDF7B0780D4CCF83
                                                                        SHA1:0FA353643AF6E5317D3FA20ED066A8CEB25A523D
                                                                        SHA-256:5E4C41580F2D61DFD8C0C5705CF000C1F3493A0F28B55EFB96C85F8915247652
                                                                        SHA-512:AC64407ACA5888CA68A57DA97FAB32D4A1A72B4BFD875D96CD1B0C342A56C0F79D5C8798044A43B2B5EFCB55B5321B3E7EF3D69162ED1F3E15546FB8272E38D7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:......9.0.7_.k...E.G....i.;..jL.se.|......1'a....g. .j..T....*1.Z.`....wm.H..}..q..|.X.,..C....(.~.,...Vq.]....k./).]..K..g.lvj..-.....Q>..sI..3....ZYm)C.SAm.X..*.%....TS.....RCK....T..Iz@.e.....:~.a.B....}L.".F...T.\.h..#.h....Y...*.W.....B..n.....H.e....Y.......?..]..4!..\..mb..1..r.......g......lc%...V.w1..A$!..t........(....D._9Ak.J....%.\......^..DxPy- ....0.-}....7H..+.wJ.....gTsA*s.....].|.8.l=^....c..,'.........e.......A.......**I..Gq1qpp.NtQ....k..-!...............ru ..O2.... .E+<I......Ni+d..C.-vcO..0j.......[..Q.4....^. .|.P...\.)u..{.0.%.(.N.........RsJ..%.......]<.0.s.0..Of.0&.SgH...._L/.c.n..|.....r..PG.j.'..*Q.........K|{.0Y^.QG6T.B.ck...q..._e3.=[....Trv...U0.s...."v.l..P.... ..?[;{r.......6......u>.....W.U..xV...UIZ".^....,.$.....Y...N../4.R=....!E@.a......W........l...P..wa..b.<....B.F..S..v...d1!c...J.w.[4.D.{S#.........I...._z.h.......w.<...qnz.....r../....E..5...G...$DK...Hc6.a.Pz=...]/."9..p+.PB..1...KS..t

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Print.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):126466
                                                                        Entropy (8bit):7.998519552063491
                                                                        Encrypted:true
                                                                        SSDEEP:3072:oFcBN80YxipTs8UywLIWILKBCaxjafL8MrqPN0LDN4d0:UcT809K3cfL825DNq0
                                                                        MD5:A7B788EBA7511284EDF7B0780D4CCF83
                                                                        SHA1:0FA353643AF6E5317D3FA20ED066A8CEB25A523D
                                                                        SHA-256:5E4C41580F2D61DFD8C0C5705CF000C1F3493A0F28B55EFB96C85F8915247652
                                                                        SHA-512:AC64407ACA5888CA68A57DA97FAB32D4A1A72B4BFD875D96CD1B0C342A56C0F79D5C8798044A43B2B5EFCB55B5321B3E7EF3D69162ED1F3E15546FB8272E38D7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:......9.0.7_.k...E.G....i.;..jL.se.|......1'a....g. .j..T....*1.Z.`....wm.H..}..q..|.X.,..C....(.~.,...Vq.]....k./).]..K..g.lvj..-.....Q>..sI..3....ZYm)C.SAm.X..*.%....TS.....RCK....T..Iz@.e.....:~.a.B....}L.".F...T.\.h..#.h....Y...*.W.....B..n.....H.e....Y.......?..]..4!..\..mb..1..r.......g......lc%...V.w1..A$!..t........(....D._9Ak.J....%.\......^..DxPy- ....0.-}....7H..+.wJ.....gTsA*s.....].|.8.l=^....c..,'.........e.......A.......**I..Gq1qpp.NtQ....k..-!...............ru ..O2.... .E+<I......Ni+d..C.-vcO..0j.......[..Q.4....^. .|.P...\.)u..{.0.%.(.N.........RsJ..%.......]<.0.s.0..Of.0&.SgH...._L/.c.n..|.....r..PG.j.'..*Q.........K|{.0Y^.QG6T.B.ck...q..._e3.=[....Trv...U0.s...."v.l..P.... ..?[;{r.......6......u>.....W.U..xV...UIZ".^....,.$.....Y...N../4.R=....!E@.a......W........l...P..wa..b.<....B.F..S..v...d1!c...J.w.[4.D.{S#.........I...._z.h.......w.<...qnz.....r../....E..5...G...$DK...Hc6.a.Pz=...]/."9..p+.PB..1...KS..t

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate1.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144235
                                                                        Entropy (8bit):7.998940806255832
                                                                        Encrypted:true
                                                                        SSDEEP:3072:NbjZh44OKt2FbLyp5uJqozZoNYfPwP0jDu14HIz6G7oxxMwKm8wJk:5jZh4dKCyTuJBzzfPq0jW4IWnxxPKm2
                                                                        MD5:892ABD1DBF38C2E9BFE631D193194E5D
                                                                        SHA1:2306ADD95C3F142A3A6EF8FB7FA78E9510DC0DE9
                                                                        SHA-256:C470B8E9DF2D6AF39C332385358BDD343CEB30882408493D6EE0F8AD61DA7302
                                                                        SHA-512:7D2E1EED840B981A6DF5A97B02FFF62FFAAB9A56D78AAD2351C764375148E42AC1425BE42AE524904C7AA587DCDC442A5E4A0BDF45107FA5A8DA39E651E8143B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:........o.07B.(B.5i.5..t.{.y........H.......$..I...H^....p....VaST......wGr.W.U.O.5.a..X{..u.....<.,........kf.%....t.#..]*.Z.Z.........H<f.B.|..H.x...p.q..2(....Z[....Lh......h"g.....~EM.f1F.I..m.X......S5..o.j]j~_....rf......... ....X.w.......a.t.o......!|0e:N.NU...L...9.8...xWz.$.s.{.....~..,g..Y.z>O...B..9...R.L........<.b.!..A.V(..k...'..=...z.7.._e<.h_.s..t,..5..q.0.V..*w.vSJ...H.....<v....$K......%............U..-].0........z.a.:........%....K.3.|....W.l.9..9.j{..0O..N..2>=..p.....x..b.H.J...Wym.....o...EKq*...<.).i...a........v&.4.#.B..7443....:....X.....&.rQP.FO..T.tJ..n..4.ii,7.[.KV.GM.t..R..>...........7..)8>.+....:Ph].[..e.L..A..2..f.e...+.(A.kt.k.....3.>H.^i.mo.....?<..".'...;r.'..'.5.4..Js......n'g?4k...{.XS.....f|..)......VJU..i.P)Q.K...bP!"~.}Ku.C.]..M..%C.c=MT.?q..j....GU.,.....\.,?_..X..2.h.JV....k..g.YE'.U.c<O......{..r.ieG..MEr.u.R_..'N.."&|......y....$B.."..X..0E.......|......(c...o.....a......?..J9..:....Vi.....8

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate1.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144235
                                                                        Entropy (8bit):7.998940806255832
                                                                        Encrypted:true
                                                                        SSDEEP:3072:NbjZh44OKt2FbLyp5uJqozZoNYfPwP0jDu14HIz6G7oxxMwKm8wJk:5jZh4dKCyTuJBzzfPq0jW4IWnxxPKm2
                                                                        MD5:892ABD1DBF38C2E9BFE631D193194E5D
                                                                        SHA1:2306ADD95C3F142A3A6EF8FB7FA78E9510DC0DE9
                                                                        SHA-256:C470B8E9DF2D6AF39C332385358BDD343CEB30882408493D6EE0F8AD61DA7302
                                                                        SHA-512:7D2E1EED840B981A6DF5A97B02FFF62FFAAB9A56D78AAD2351C764375148E42AC1425BE42AE524904C7AA587DCDC442A5E4A0BDF45107FA5A8DA39E651E8143B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:........o.07B.(B.5i.5..t.{.y........H.......$..I...H^....p....VaST......wGr.W.U.O.5.a..X{..u.....<.,........kf.%....t.#..]*.Z.Z.........H<f.B.|..H.x...p.q..2(....Z[....Lh......h"g.....~EM.f1F.I..m.X......S5..o.j]j~_....rf......... ....X.w.......a.t.o......!|0e:N.NU...L...9.8...xWz.$.s.{.....~..,g..Y.z>O...B..9...R.L........<.b.!..A.V(..k...'..=...z.7.._e<.h_.s..t,..5..q.0.V..*w.vSJ...H.....<v....$K......%............U..-].0........z.a.:........%....K.3.|....W.l.9..9.j{..0O..N..2>=..p.....x..b.H.J...Wym.....o...EKq*...<.).i...a........v&.4.#.B..7443....:....X.....&.rQP.FO..T.tJ..n..4.ii,7.[.KV.GM.t..R..>...........7..)8>.+....:Ph].[..e.L..A..2..f.e...+.(A.kt.k.....3.>H.^i.mo.....?<..".'...;r.'..'.5.4..Js......n'g?4k...{.XS.....f|..)......VJU..i.P)Q.K...bP!"~.}Ku.C.]..M..%C.c=MT.?q..j....GU.,.....\.,?_..X..2.h.JV....k..g.YE'.U.c<O......{..r.ieG..MEr.u.R_..'N.."&|......y....$B.."..X..0E.......|......(c...o.....a......?..J9..:....Vi.....8

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate10.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144266
                                                                        Entropy (8bit):7.998507310301234
                                                                        Encrypted:true
                                                                        SSDEEP:3072:shsBsdrhxjW/i5z133VBsIe6omd2jc7GbhCPHn/:shCs/xAK53FWb6UcSbUPHn/
                                                                        MD5:DEAE36452E8CC7C7E35573150E2B9E21
                                                                        SHA1:306A3859414C999CC05A3B504E151012796EF3F9
                                                                        SHA-256:ECED3BCA33B764E21172E0FFD54D9FF1FAA12CBF43A3A1B62F9E0EEA205B3677
                                                                        SHA-512:2DBBBF9A8A328FABF25C2ADDE4F8BA151D05C3BF5FCE648BA1E546B04089A4CD47F0B8266A390B59DD57CEEE8EC3A467E4DC545D935648D42F4DCD43B3771200
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....|..I..Vj.7\.y...`.p8...r\5.......".......0...aY$....I..u|C...!.h.n..9\.TC.>5..&z........7..Gq...7.9...6.....H...^<.+....."I..q.y./zo.H.VTFyQ.5......CR....._M|:..De..S9..'...a...../(..'.C..w..... X....<.@..W#.d3.|Gv.&....,....p.[nZ......5....~^_.7.S.L...4!j<.m.).X.^....7.....zYf..E..l.....,...u.].Z.).~.g.lPL..|...6`.*.l.........N..... .9...wi..=.`)....."..g<2'-.A.$r....fQe.....].?.Q.c..Q..6't3(..{.i...M..c..2..S.........M]...{.Io.c.G.-..3iT.{6p....De..v....`.......n..!)..........3s.S|..D?..B..KY./.{/.H\.J....L.......%/.x.1.*..5.......`.G2.g.TC.Ht&..G.i.i.,......H.[......).Z...k. ..v#Q.I....P0#.x.C....^GWeg."c..g...f..a*..e.6.. ...s..^n9....y.Jp+.d.x...?J*.d...M.($9.L......S.......wmd7........]0..>..)@.}.".!.u.......b.t.x....KRT.....'..........=...|.Ru...c...p..m^./....h...=....U.Q.~4..P.......u.[......-.......i.g..K......>.-?.......-......D........V...,o.}....j`f..0....vi.|U..9.+.7..A...K..g....8%m..g."".x...B.Qz..@.//`..(}...b.bh..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate10.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144266
                                                                        Entropy (8bit):7.998507310301234
                                                                        Encrypted:true
                                                                        SSDEEP:3072:shsBsdrhxjW/i5z133VBsIe6omd2jc7GbhCPHn/:shCs/xAK53FWb6UcSbUPHn/
                                                                        MD5:DEAE36452E8CC7C7E35573150E2B9E21
                                                                        SHA1:306A3859414C999CC05A3B504E151012796EF3F9
                                                                        SHA-256:ECED3BCA33B764E21172E0FFD54D9FF1FAA12CBF43A3A1B62F9E0EEA205B3677
                                                                        SHA-512:2DBBBF9A8A328FABF25C2ADDE4F8BA151D05C3BF5FCE648BA1E546B04089A4CD47F0B8266A390B59DD57CEEE8EC3A467E4DC545D935648D42F4DCD43B3771200
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....|..I..Vj.7\.y...`.p8...r\5.......".......0...aY$....I..u|C...!.h.n..9\.TC.>5..&z........7..Gq...7.9...6.....H...^<.+....."I..q.y./zo.H.VTFyQ.5......CR....._M|:..De..S9..'...a...../(..'.C..w..... X....<.@..W#.d3.|Gv.&....,....p.[nZ......5....~^_.7.S.L...4!j<.m.).X.^....7.....zYf..E..l.....,...u.].Z.).~.g.lPL..|...6`.*.l.........N..... .9...wi..=.`)....."..g<2'-.A.$r....fQe.....].?.Q.c..Q..6't3(..{.i...M..c..2..S.........M]...{.Io.c.G.-..3iT.{6p....De..v....`.......n..!)..........3s.S|..D?..B..KY./.{/.H\.J....L.......%/.x.1.*..5.......`.G2.g.TC.Ht&..G.i.i.,......H.[......).Z...k. ..v#Q.I....P0#.x.C....^GWeg."c..g...f..a*..e.6.. ...s..^n9....y.Jp+.d.x...?J*.d...M.($9.L......S.......wmd7........]0..>..)@.}.".!.u.......b.t.x....KRT.....'..........=...|.Ru...c...p..m^./....h...=....U.Q.~4..P.......u.[......-.......i.g..K......>.-?.......-......D........V...,o.}....j`f..0....vi.|U..9.+.7..A...K..g....8%m..g."".x...B.Qz..@.//`..(}...b.bh..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate2.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144444
                                                                        Entropy (8bit):7.998697415680831
                                                                        Encrypted:true
                                                                        SSDEEP:3072:uwr1fAa8IIMoWPYrjJ9ZRrWUDl1BNo86LiLM9uK6iJi2MDA0t:xrbGMKHJ9PrWUDxEiQIqiRDA0t
                                                                        MD5:D3EA0E21B1D10F20CC862857D5743430
                                                                        SHA1:40CE4D45F178D18F0F0D53E8F70F99D94780F82B
                                                                        SHA-256:A5BAFD63407641DC2583311642CF995A4EFA08BC0FBB25B32B7C384D9B4B8F04
                                                                        SHA-512:6D152A32EBBC7C68C0F6C3D608D1A43B0FBBADC7DC0130BC8330A72EE9FE322D20EE369178D92EB00F102D9B4D62F7E482B9092487AEAF00C73818BFCD2284FF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:......_.P..?J.......BTL..x...3&v=......c.r...._{.,.6...K...../m.n..H~.E.T)*Z}H...Y...#.yBu.d.....s...{3.ge^W9.....a.J.Jw........Y]....`.".z. n....\Ks.f..j\..4.K..4{=O..d....y4".....y..D..v....k}._R..D..i.u..H..u...g..R2.c.C.1..O&8...m.!.8my`.@a...Lk..\.J......x.q.&.....nf.ab./.(............=..L>...........S.].4.H...B.L..2..g-...p.L...I.n.t..,..F..U.qX..Q..4..%.+)...=v.....s.....G..]..Fb.B......m.....,...7.~a .8.M.Crxw....4b%.W.D..........-e.VQ.c,>..p..4...:{..L.<.kt6B.47|.Z.........f....H......x...I}.5.W64{.......D.<q.7On..H.l...:....u.......M.....JR.R7.......MC...D'...q.P...'.Xm.4..E.e.\G.YB1i.i-.x..E>Z.0ei.......RWm.03&...F....r:..q:XEG.jV.W...T..t..e.6........T...<=.iH.U)..'....,...;H.....]/....K...."X.......'.=!T#v...Y.V..>u.\..[.......J.N.mb...^..t...DH?.......3..w\.h].. s..Kt..[.r..{8p.K+.?r..Z}..a..~.....f+.-o.Wi...m..BXm.0...N{..%..o.{.........S0..l....xWQh... ...S..-..Y...,.TgSP.=h....4...7.&..<.0.4-..+#.5.......

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate2.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144444
                                                                        Entropy (8bit):7.998697415680831
                                                                        Encrypted:true
                                                                        SSDEEP:3072:uwr1fAa8IIMoWPYrjJ9ZRrWUDl1BNo86LiLM9uK6iJi2MDA0t:xrbGMKHJ9PrWUDxEiQIqiRDA0t
                                                                        MD5:D3EA0E21B1D10F20CC862857D5743430
                                                                        SHA1:40CE4D45F178D18F0F0D53E8F70F99D94780F82B
                                                                        SHA-256:A5BAFD63407641DC2583311642CF995A4EFA08BC0FBB25B32B7C384D9B4B8F04
                                                                        SHA-512:6D152A32EBBC7C68C0F6C3D608D1A43B0FBBADC7DC0130BC8330A72EE9FE322D20EE369178D92EB00F102D9B4D62F7E482B9092487AEAF00C73818BFCD2284FF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:......_.P..?J.......BTL..x...3&v=......c.r...._{.,.6...K...../m.n..H~.E.T)*Z}H...Y...#.yBu.d.....s...{3.ge^W9.....a.J.Jw........Y]....`.".z. n....\Ks.f..j\..4.K..4{=O..d....y4".....y..D..v....k}._R..D..i.u..H..u...g..R2.c.C.1..O&8...m.!.8my`.@a...Lk..\.J......x.q.&.....nf.ab./.(............=..L>...........S.].4.H...B.L..2..g-...p.L...I.n.t..,..F..U.qX..Q..4..%.+)...=v.....s.....G..]..Fb.B......m.....,...7.~a .8.M.Crxw....4b%.W.D..........-e.VQ.c,>..p..4...:{..L.<.kt6B.47|.Z.........f....H......x...I}.5.W64{.......D.<q.7On..H.l...:....u.......M.....JR.R7.......MC...D'...q.P...'.Xm.4..E.e.\G.YB1i.i-.x..E>Z.0ei.......RWm.03&...F....r:..q:XEG.jV.W...T..t..e.6........T...<=.iH.U)..'....,...;H.....]/....K...."X.......'.=!T#v...Y.V..>u.\..[.......J.N.mb...^..t...DH?.......3..w\.h].. s..Kt..[.r..{8p.K+.?r..Z}..a..~.....f+.-o.Wi...m..BXm.0...N{..%..o.{.........S0..l....xWQh... ...S..-..Y...,.TgSP.=h....4...7.&..<.0.4-..+#.5.......

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate3.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144485
                                                                        Entropy (8bit):7.998769443599606
                                                                        Encrypted:true
                                                                        SSDEEP:3072:ldKQAbJMq9uIeqxEOxrxNFKPgFx6/TqXSwsCOYOQ4RERBZc6UNsVFufTTYDo:TJ2uBkEOxdJO/TqpsCOYOQ4RQBS6UCVu
                                                                        MD5:28F64B6F6B98516E3CB6DBBDBAF5B995
                                                                        SHA1:CC849C8120446B73E36858A61672DF25DE1AE646
                                                                        SHA-256:E8C21FB603116ADE8A050390B5115951ECFA4A15D72494E5D357E688A56F860C
                                                                        SHA-512:17937FE8A79D37E1C39859C4D9956FFA2E74962FA896C97E16919E6316AE5C2397AB56469E913A179EEE03177A5679D3BD824C3209192FAE5D2BD94459BDD65B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:........"....*|.....?...e.....~..?.a+.,O3.&..O_%9..y.W..e...1bA.....h..[.}.q..}..... .6ez.25.[.L506q....uI.rJA..k.Z....I\..D.l.y.7}Ax.k..,.=.......\.m...1g..f...Z...h..F..idP...#.....B?a^+.] .'l.......q........+`..x|..l=..-.......@.*\ ..._]s2.d........I.tk..]../*.s.(m.v.$....2.1.^uj...}.....,.=..X.o........&WEd!.._.q.=.C"d..zi2....J..l....s. >......h..C.......ek....Nw..u.....".hQ....\.....@.......=....t.....o...Q..-.1.%`..$.R2-Y.n'..4..R.....E";.w.%.+.d$T{.5.\.o5.{...... ../..G..{l...1.Vf,X4S....;..u]B...a5<I.;..p..@[.!g..MF.M..I..{.z.!...1.J..GY.T...._C.=n.y..\...p.a...I]m1.'.{..K....x..<...MZ.F.1..2.p..`.....aN..N..U>;3.6.k.Hh.@...M..}..VIw.a...r.G~b.6.Qx....._...|....;`...BS..Z.d..._..U{.-B.l..7|........;..X'.+V.&x..G....R...).RQ..Q{....'.X...[V....C.E.?.*)C......g3~._BB%.|..;(...j.....d3.~..........\...W........E...o..r.....<.]._.5h.[.}........b..@..#..A.=....}+..j......L.U.6CqMyuJ.m......Qf..........u...H'..... .M...cZ.....+.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate3.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144485
                                                                        Entropy (8bit):7.998769443599606
                                                                        Encrypted:true
                                                                        SSDEEP:3072:ldKQAbJMq9uIeqxEOxrxNFKPgFx6/TqXSwsCOYOQ4RERBZc6UNsVFufTTYDo:TJ2uBkEOxdJO/TqpsCOYOQ4RQBS6UCVu
                                                                        MD5:28F64B6F6B98516E3CB6DBBDBAF5B995
                                                                        SHA1:CC849C8120446B73E36858A61672DF25DE1AE646
                                                                        SHA-256:E8C21FB603116ADE8A050390B5115951ECFA4A15D72494E5D357E688A56F860C
                                                                        SHA-512:17937FE8A79D37E1C39859C4D9956FFA2E74962FA896C97E16919E6316AE5C2397AB56469E913A179EEE03177A5679D3BD824C3209192FAE5D2BD94459BDD65B
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:........"....*|.....?...e.....~..?.a+.,O3.&..O_%9..y.W..e...1bA.....h..[.}.q..}..... .6ez.25.[.L506q....uI.rJA..k.Z....I\..D.l.y.7}Ax.k..,.=.......\.m...1g..f...Z...h..F..idP...#.....B?a^+.] .'l.......q........+`..x|..l=..-.......@.*\ ..._]s2.d........I.tk..]../*.s.(m.v.$....2.1.^uj...}.....,.=..X.o........&WEd!.._.q.=.C"d..zi2....J..l....s. >......h..C.......ek....Nw..u.....".hQ....\.....@.......=....t.....o...Q..-.1.%`..$.R2-Y.n'..4..R.....E";.w.%.+.d$T{.5.\.o5.{...... ../..G..{l...1.Vf,X4S....;..u]B...a5<I.;..p..@[.!g..MF.M..I..{.z.!...1.J..GY.T...._C.=n.y..\...p.a...I]m1.'.{..K....x..<...MZ.F.1..2.p..`.....aN..N..U>;3.6.k.Hh.@...M..}..VIw.a...r.G~b.6.Qx....._...|....;`...BS..Z.d..._..U{.-B.l..7|........;..X'.+V.&x..G....R...).RQ..Q{....'.X...[V....C.E.?.*)C......g3~._BB%.|..;(...j.....d3.~..........\...W........E...o..r.....<.]._.5h.[.}........b..@..#..A.=....}+..j......L.U.6CqMyuJ.m......Qf..........u...H'..... .M...cZ.....+.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate4.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144367
                                                                        Entropy (8bit):7.998676674455733
                                                                        Encrypted:true
                                                                        SSDEEP:3072:FqfKNxgSYSEzUZlotc7Wion1KM8XrAyX5N/2DQjLm:FWHtSFZ977on1KMUrAypN/3jLm
                                                                        MD5:20B0A99BF0A1682843EB421495516611
                                                                        SHA1:3A62931CE41450C818503809E0850141C8AC3D6D
                                                                        SHA-256:64A862DC6608CAD58C66863ABF77297890C784B9A6F47989DBD7A66B4220581E
                                                                        SHA-512:2D248E0A15E39A08A5502D574923CC3408279D53528EBADC9A25D5ADAEEF25B1AF543C5AED3646B6629DF79326F83ACA40102F669B6268448166F6A7026D53DB
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.......|.v.v..OXb5...F/.-S.xT...l+;_.k.J..p$.N...5....`Y....{*x.T.N...2.;,...;....)..........Y.6.Ls.}.......-.ES...)j....L....d.....r..R.7....[Q.....?$..|&.......y?........&.d.f.../._.n.._.5}niy..h]l...8z.7..t=..d..$..,.$....b...U@,....M..{r.A.p.._.jf....#.v..x1.%0=H.^w..8...Ku.eV..(,...Ya.......].b..-].. .zc.x<..c.}+.6..}&.>..T...4D.....W.J.q..@..........4g$..e}Te..7. .eU..q.u.^.v...u..U.{,3.......}~....sb..;...U..<y..W.V.~.DHC.\5...gZ.o..!>g.p...Y./.c.`I......`[?..f..}.2v.?.xLN...Y..'..P..........{!...=..j..~i...O....H}..7O.,..goVD....f.Sl.....9..bv..xa...X......P.?......Im.{..eH.......~$...S.9...b.[.2M.lj\"..V..$.>.z.T.0.H..[.Nd..:L....uW"k........d.L..n..E.....q.<C..>.Z..s...a..@h..X:E.2......<]..w.T........c.z..s)FY_c..gz...I.@......GI;......R..l.4qv".g#]<....e.5_.Oi......^.y.......P.i.6.. .MDh.I...l..+...."..k..~......./...p~Zo............1...i.........{...9..R.U$.3&.R.P..8.I..;...Q.o.;.6.X..?w..rZ.B]x.......(<yu...E3&g....79..S..z

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate4.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144367
                                                                        Entropy (8bit):7.998676674455733
                                                                        Encrypted:true
                                                                        SSDEEP:3072:FqfKNxgSYSEzUZlotc7Wion1KM8XrAyX5N/2DQjLm:FWHtSFZ977on1KMUrAypN/3jLm
                                                                        MD5:20B0A99BF0A1682843EB421495516611
                                                                        SHA1:3A62931CE41450C818503809E0850141C8AC3D6D
                                                                        SHA-256:64A862DC6608CAD58C66863ABF77297890C784B9A6F47989DBD7A66B4220581E
                                                                        SHA-512:2D248E0A15E39A08A5502D574923CC3408279D53528EBADC9A25D5ADAEEF25B1AF543C5AED3646B6629DF79326F83ACA40102F669B6268448166F6A7026D53DB
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.......|.v.v..OXb5...F/.-S.xT...l+;_.k.J..p$.N...5....`Y....{*x.T.N...2.;,...;....)..........Y.6.Ls.}.......-.ES...)j....L....d.....r..R.7....[Q.....?$..|&.......y?........&.d.f.../._.n.._.5}niy..h]l...8z.7..t=..d..$..,.$....b...U@,....M..{r.A.p.._.jf....#.v..x1.%0=H.^w..8...Ku.eV..(,...Ya.......].b..-].. .zc.x<..c.}+.6..}&.>..T...4D.....W.J.q..@..........4g$..e}Te..7. .eU..q.u.^.v...u..U.{,3.......}~....sb..;...U..<y..W.V.~.DHC.\5...gZ.o..!>g.p...Y./.c.`I......`[?..f..}.2v.?.xLN...Y..'..P..........{!...=..j..~i...O....H}..7O.,..goVD....f.Sl.....9..bv..xa...X......P.?......Im.{..eH.......~$...S.9...b.[.2M.lj\"..V..$.>.z.T.0.H..[.Nd..:L....uW"k........d.L..n..E.....q.<C..>.Z..s...a..@h..X:E.2......<]..w.T........c.z..s)FY_c..gz...I.@......GI;......R..l.4qv".g#]<....e.5_.Oi......^.y.......P.i.6.. .MDh.I...l..+...."..k..~......./...p~Zo............1...i.........{...9..R.U$.3&.R.P..8.I..;...Q.o.;.6.X..?w..rZ.B]x.......(<yu...E3&g....79..S..z

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate5.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144205
                                                                        Entropy (8bit):7.998680498605322
                                                                        Encrypted:true
                                                                        SSDEEP:3072:t/Ek8pOiJlFaj5/CejDwl/JSiPf5L8Z2r0pYcvGT9K7M+8voqq34hhC:t/EkqxlFaj5qUw3hf5gZnpY7TQ7PKolb
                                                                        MD5:2CEF6B13515C0C1063998CF8FED740D6
                                                                        SHA1:65FFA6CAE19619FD94C4A65369172E619EE975C0
                                                                        SHA-256:09BEBB735F5CC17B609979CBF28640DC194DFFCC56607BF7FB73EC6ECA8005E2
                                                                        SHA-512:D03E1795A871B2FB2CE92BA3B40B46251A671195AA32FAC30E299F5FCDEDAFF1731C4C401A26EE8961D5EA50950ABAD0AA6458B37EE7DA3F35FE7EE52FC2A649
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....X....w.N.....jt}..)^..t....~c......^hk.....%qfNT...f.._..R8n"..`.n.....n.....$+.......,......XU.l.c.^....0".Gu.1....].59.#..._.5?.%G......c..m~./c.c.W~:......9.1.z.m...]W{.d..';....VA.e.]...l..s.HHo.(./.c..}F)b.....TE...[.V.=r..,9.i......=....^.S2..-.5....M..t.tE..j...........!d.{..(.2=to.=.i+9../....p....h..g?...\....3.6..$q...C:.&.Aj..G....#.N.1eU..~..2n..O......JL!.s.c.l.<..YL(....=..C.;..l.n..2:..O.EC.+..F........>`4...vS.>D%|..&.....qA.......G....6HG......s...D....:.1..!.."[ ..4e....t....... ...*.Os...u?NN.,..^...m..l..V... ..NL...cO.G...9..$.L.$...KsNN... ..P6&..3...1.y..m.Xp....|q .(. o_i......}.=.....[^|1......KB..3....wM....3.5.9KS..........B.i.4...S]p.gp.~o.N..65.o.....O..'...)....e....!...Cd.q...IlW..N.j."...4..4OU. -.D?....3....#V=!. ....'b...[c$..`W...n?.....Sld.E*. ..&W^Q.+...X^.......(0.T..2x.....h#.Mf.........L.,>V...G.y..J*.l<o.W...L%....O...Y...l..2..l._.."%.q..f...J&7<.u.............Hka.wm}.RH..kZu<...Q.sW.ql.0.^...7.B....C.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate5.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144205
                                                                        Entropy (8bit):7.998680498605322
                                                                        Encrypted:true
                                                                        SSDEEP:3072:t/Ek8pOiJlFaj5/CejDwl/JSiPf5L8Z2r0pYcvGT9K7M+8voqq34hhC:t/EkqxlFaj5qUw3hf5gZnpY7TQ7PKolb
                                                                        MD5:2CEF6B13515C0C1063998CF8FED740D6
                                                                        SHA1:65FFA6CAE19619FD94C4A65369172E619EE975C0
                                                                        SHA-256:09BEBB735F5CC17B609979CBF28640DC194DFFCC56607BF7FB73EC6ECA8005E2
                                                                        SHA-512:D03E1795A871B2FB2CE92BA3B40B46251A671195AA32FAC30E299F5FCDEDAFF1731C4C401A26EE8961D5EA50950ABAD0AA6458B37EE7DA3F35FE7EE52FC2A649
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....X....w.N.....jt}..)^..t....~c......^hk.....%qfNT...f.._..R8n"..`.n.....n.....$+.......,......XU.l.c.^....0".Gu.1....].59.#..._.5?.%G......c..m~./c.c.W~:......9.1.z.m...]W{.d..';....VA.e.]...l..s.HHo.(./.c..}F)b.....TE...[.V.=r..,9.i......=....^.S2..-.5....M..t.tE..j...........!d.{..(.2=to.=.i+9../....p....h..g?...\....3.6..$q...C:.&.Aj..G....#.N.1eU..~..2n..O......JL!.s.c.l.<..YL(....=..C.;..l.n..2:..O.EC.+..F........>`4...vS.>D%|..&.....qA.......G....6HG......s...D....:.1..!.."[ ..4e....t....... ...*.Os...u?NN.,..^...m..l..V... ..NL...cO.G...9..$.L.$...KsNN... ..P6&..3...1.y..m.Xp....|q .(. o_i......}.=.....[^|1......KB..3....wM....3.5.9KS..........B.i.4...S]p.gp.~o.N..65.o.....O..'...)....e....!...Cd.q...IlW..N.j."...4..4OU. -.D?....3....#V=!. ....'b...[c$..`W...n?.....Sld.E*. ..&W^Q.+...X^.......(0.T..2x.....h#.Mf.........L.,>V...G.y..J*.l<o.W...L%....O...Y...l..2..l._.."%.q..f...J&7<.u.............Hka.wm}.RH..kZu<...Q.sW.ql.0.^...7.B....C.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate6.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144215
                                                                        Entropy (8bit):7.998630133591664
                                                                        Encrypted:true
                                                                        SSDEEP:3072:YPKbeFIQuKra/5VefQgU+ajXqVX3JzQEJhx37WScI4zGROu1x9:YVFIQu6axAoLfjXqB2gaI4GH9
                                                                        MD5:F6CD31C0F2E50B259BAF5DD5377D8966
                                                                        SHA1:8F146367EE4AA3AA527D9C6ED231F0A4202F5D7D
                                                                        SHA-256:D8DED2D0B72B2D537D0AFF7A8979251874DE488CFD9630EB875C70ADAEA774D6
                                                                        SHA-512:5D1669798185BD1B3220871A2809E5AB6A0912EB77EF42F204D4945601F62ADA328AC7E8C819BD1EC30153A2FF95EBA135DFB598FBE399F954C9E00E08646695
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....>8E.Lqq.....?9d..n.F..-..rM..0]*..F.?......z....N.zC..Z.\.K.?)=...'.3.3S..P....jpw#..}4'...0..5..J....|F......w..-_...$...:.k`.~x..BP..8.T.F..A'....T0,..q.1B....9..g<..}.C~;+.F...P.;q6...r.z..5E..mzkL..;.Z..GU$;..Q.z...gm...o|.....|......_......aJ../%lb.uo.j\..A)...]M....}.\...I.{..C...b...0.q....3...OE.......c...G....uy...5....s.?u...E.._..0..].Z.+.s.t...S...>.rF..v...#.._..t...ECR.W0.,..F.....u...cT.RZ7F...BF.%..|ey....*. ..p[.5C9e..T:..Y..c..K..LNG.~.V....)a..+...".....d.2.D"?.nE.....(...=1=.b..U.o...FY<.oN.,.B.8.4.$.n.s&............p/.-n...*........?.3........N.E.vi...g"..(.=3;.<...Vw.-.YE".<.0$M.._...+s`o$.........._..Wj.W.E..9.m=....E..I..Lv......$hc....$.zE. ..jG8/....r.K...f.[...T.-BBF..s%..nb"...%. n.'S-.1..^.##~9..-../1}..y....Is}.).^.j..w..y.jL.a..i..f.^...VN*...........m?TI......u.........Xp[..1:......._,......U....7.".....~%.3....z0~.9a...$..#!...kx.#$.f.p.@..j......B..v.:.c..)......~.....+...S...T.8._

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate6.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144215
                                                                        Entropy (8bit):7.998630133591664
                                                                        Encrypted:true
                                                                        SSDEEP:3072:YPKbeFIQuKra/5VefQgU+ajXqVX3JzQEJhx37WScI4zGROu1x9:YVFIQu6axAoLfjXqB2gaI4GH9
                                                                        MD5:F6CD31C0F2E50B259BAF5DD5377D8966
                                                                        SHA1:8F146367EE4AA3AA527D9C6ED231F0A4202F5D7D
                                                                        SHA-256:D8DED2D0B72B2D537D0AFF7A8979251874DE488CFD9630EB875C70ADAEA774D6
                                                                        SHA-512:5D1669798185BD1B3220871A2809E5AB6A0912EB77EF42F204D4945601F62ADA328AC7E8C819BD1EC30153A2FF95EBA135DFB598FBE399F954C9E00E08646695
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....>8E.Lqq.....?9d..n.F..-..rM..0]*..F.?......z....N.zC..Z.\.K.?)=...'.3.3S..P....jpw#..}4'...0..5..J....|F......w..-_...$...:.k`.~x..BP..8.T.F..A'....T0,..q.1B....9..g<..}.C~;+.F...P.;q6...r.z..5E..mzkL..;.Z..GU$;..Q.z...gm...o|.....|......_......aJ../%lb.uo.j\..A)...]M....}.\...I.{..C...b...0.q....3...OE.......c...G....uy...5....s.?u...E.._..0..].Z.+.s.t...S...>.rF..v...#.._..t...ECR.W0.,..F.....u...cT.RZ7F...BF.%..|ey....*. ..p[.5C9e..T:..Y..c..K..LNG.~.V....)a..+...".....d.2.D"?.nE.....(...=1=.b..U.o...FY<.oN.,.B.8.4.$.n.s&............p/.-n...*........?.3........N.E.vi...g"..(.=3;.<...Vw.-.YE".<.0$M.._...+s`o$.........._..Wj.W.E..9.m=....E..I..Lv......$hc....$.zE. ..jG8/....r.K...f.[...T.-BBF..s%..nb"...%. n.'S-.1..^.##~9..-../1}..y....Is}.).^.j..w..y.jL.a..i..f.^...VN*...........m?TI......u.........Xp[..1:......._,......U....7.".....~%.3....z0~.9a...$..#!...kx.#$.f.p.@..j......B..v.:.c..)......~.....+...S...T.8._

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate7.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144418
                                                                        Entropy (8bit):7.998831568932276
                                                                        Encrypted:true
                                                                        SSDEEP:3072:OM3Jw+HPLjUO0lU11DemLmPiNmK/KZtUN5I9m9SksFhXFBV:OaJjHPL3AUDLqPiP/KZtUN5+oeVz
                                                                        MD5:949233C687ED9091B824435B20432A4E
                                                                        SHA1:6AF6CC91BC92F4270004A20401E7783F03CF353D
                                                                        SHA-256:702C8840B9E3A57CB8C160D7D5A6AB867EF1061AE71E1DA498405F2BC22B779B
                                                                        SHA-512:DFBC1C04F2A38E018314EFE889F3095EC896429C7D4721FD89D00AB5F073AF7CCD00BEC91BBF1C5CDD45EE5823E3A72C4E5066C7673C44ADBDF9302C07030764
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....J.B.g....m6.......F.g.g......'|.......U......Pd.....pa..$F.0....G"k....#.P.bIFv.rt..'*^.M..y....zx.g.H2.....;...s.-=g.rD/U.<..4...x...Y.Fh..#n...W..4Q\..F..u...x(=...e#.|N../...[.`...Z.;.gWB?...l.M.........;.{.c..".0].?....L....h......L.#.......4.s..owq:......;C3.......C..._...~.8ezt.8.Euf2....N...[2.v..D-.a..).S%.z..6s.Kx..z..3.%.!.........M.....CA....Qt.j...'...O}1..A.ch...M.L..a2.x ....8"....=:.{........'0..8.Pd..2.e.km`=..+...V..L.kN.b..Hv.L..h....L.J...........X!%.........U`....RD....B.Wmt....m.8..(o.......@40..@............Z..\.a)!).O..IZ..O{(.].I..M...<.r~.......bq..~..[.}9Nc....%...j..`...e..vj.J..{.C...+`. ....1....}...8UD.W>..#4...Ky2B0.%.S.*?.%.z+....x....l...,.=..!...GC.....f.....8...{p.xB....hw.>-f.a9/.B_.x.$..;.j,.....t...$8D.a..&....hk..........xU(?j.E....5S k.k......?:..n..'7.A.e..}{WW.j...w.w..>.Z.U../.....g@..,y.>X.P...+z.{ ....K.q.%.0/hV..f?J.s4k"t..7..:.*.Jj..?..>.......MN.....h..:o}..u.F.nV..4.F.T3N....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate7.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144418
                                                                        Entropy (8bit):7.998831568932276
                                                                        Encrypted:true
                                                                        SSDEEP:3072:OM3Jw+HPLjUO0lU11DemLmPiNmK/KZtUN5I9m9SksFhXFBV:OaJjHPL3AUDLqPiP/KZtUN5+oeVz
                                                                        MD5:949233C687ED9091B824435B20432A4E
                                                                        SHA1:6AF6CC91BC92F4270004A20401E7783F03CF353D
                                                                        SHA-256:702C8840B9E3A57CB8C160D7D5A6AB867EF1061AE71E1DA498405F2BC22B779B
                                                                        SHA-512:DFBC1C04F2A38E018314EFE889F3095EC896429C7D4721FD89D00AB5F073AF7CCD00BEC91BBF1C5CDD45EE5823E3A72C4E5066C7673C44ADBDF9302C07030764
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....J.B.g....m6.......F.g.g......'|.......U......Pd.....pa..$F.0....G"k....#.P.bIFv.rt..'*^.M..y....zx.g.H2.....;...s.-=g.rD/U.<..4...x...Y.Fh..#n...W..4Q\..F..u...x(=...e#.|N../...[.`...Z.;.gWB?...l.M.........;.{.c..".0].?....L....h......L.#.......4.s..owq:......;C3.......C..._...~.8ezt.8.Euf2....N...[2.v..D-.a..).S%.z..6s.Kx..z..3.%.!.........M.....CA....Qt.j...'...O}1..A.ch...M.L..a2.x ....8"....=:.{........'0..8.Pd..2.e.km`=..+...V..L.kN.b..Hv.L..h....L.J...........X!%.........U`....RD....B.Wmt....m.8..(o.......@40..@............Z..\.a)!).O..IZ..O{(.].I..M...<.r~.......bq..~..[.}9Nc....%...j..`...e..vj.J..{.C...+`. ....1....}...8UD.W>..#4...Ky2B0.%.S.*?.%.z+....x....l...,.=..!...GC.....f.....8...{p.xB....hw.>-f.a9/.B_.x.$..;.j,.....t...$8D.a..&....hk..........xU(?j.E....5S k.k......?:..n..'7.A.e..}{WW.j...w.w..>.Z.U../.....g@..,y.>X.P...+z.{ ....K.q.%.0/hV..f?J.s4k"t..7..:.*.Jj..?..>.......MN.....h..:o}..u.F.nV..4.F.T3N....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate8.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144169
                                                                        Entropy (8bit):7.998783465575098
                                                                        Encrypted:true
                                                                        SSDEEP:3072:cYyoU+wd7KxpmkB54WpEbAdwC8qFF3REYf775oVZjAt6F7:g+wd7KfmkvFpEbywCXCYj7a6t6F7
                                                                        MD5:06F03EE5F1AC8ADA4ED3F6CA8F7D47F2
                                                                        SHA1:40463523FD95EF2AA69D97FEE28BAE0176B84860
                                                                        SHA-256:FDAE09B87B5A59583B67F22E1F48DA6D8AFD873E74A4408396030CF60D57D013
                                                                        SHA-512:776EA60F57E30626885ED643D3CE3CA7C36A5B1697EEF13F6D097046CC2D2B5CF1D6019E69C86E94DEAB9778EB5A9DE724D968BFC9F6F17E901F4DE80C3E8698
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.........A....d5&..Cfu.......H..m.w.a.O.....".........`.2T.U]...1n.?....G.+b.i.v~j5...2A?..k..|.W.;..|..e.!...f.[.^..HA....G..NaTjpz..?CV..w..C..%.....1.}k...Hq.N....l4..t.....X....0xpY..]~U....d...X..9.]..^}.D..)U...vbf^=....0 l......8.5J.....<^.Eg.............d.#.]....p....k..miOBk..9...,6..H;..=.^K.=~s.x...1o...Z.Q[,@.ej..x91...x.. .P.=d....=3....p[n..jF .4..9..].......YK.c#q^.....L.^..........;.....D.c.-d.....T.:..\r.2S.;.{...|fi'.6U..n.......P...j:mH8<....V..U..rW......|.T.c6..,.....Unm&......I'...^......{.).0P.f..."0.-Q.*L..e..ThM.p9..:....gd+K.i..Z...v.*.J.O.q...~..+Tcv.Q...v..{.Y .....5.4..z9R@.f%.}.1.+..8.[^..^.....q.S#...!...=..RC....i..y..0.q0J...,!.p..\7.W.......M_.e.t..>....U.F...@..}.M.o.VU.dI.q=F_.~...i...D...+*)h.yV.J}8....Y..K.&f.Qi...A..+.. .....Z...sdc......mm.....d...w...@...4:...l...5..n....6cv....v.....7m."j..2.9...LD.-.48%_....aq....|..]..o.i..j..IdZ..P..N.H.......yv...O...4x....*E}..~...%..d.L...^^\..@....#5..I\.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate8.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144169
                                                                        Entropy (8bit):7.998783465575098
                                                                        Encrypted:true
                                                                        SSDEEP:3072:cYyoU+wd7KxpmkB54WpEbAdwC8qFF3REYf775oVZjAt6F7:g+wd7KfmkvFpEbywCXCYj7a6t6F7
                                                                        MD5:06F03EE5F1AC8ADA4ED3F6CA8F7D47F2
                                                                        SHA1:40463523FD95EF2AA69D97FEE28BAE0176B84860
                                                                        SHA-256:FDAE09B87B5A59583B67F22E1F48DA6D8AFD873E74A4408396030CF60D57D013
                                                                        SHA-512:776EA60F57E30626885ED643D3CE3CA7C36A5B1697EEF13F6D097046CC2D2B5CF1D6019E69C86E94DEAB9778EB5A9DE724D968BFC9F6F17E901F4DE80C3E8698
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.........A....d5&..Cfu.......H..m.w.a.O.....".........`.2T.U]...1n.?....G.+b.i.v~j5...2A?..k..|.W.;..|..e.!...f.[.^..HA....G..NaTjpz..?CV..w..C..%.....1.}k...Hq.N....l4..t.....X....0xpY..]~U....d...X..9.]..^}.D..)U...vbf^=....0 l......8.5J.....<^.Eg.............d.#.]....p....k..miOBk..9...,6..H;..=.^K.=~s.x...1o...Z.Q[,@.ej..x91...x.. .P.=d....=3....p[n..jF .4..9..].......YK.c#q^.....L.^..........;.....D.c.-d.....T.:..\r.2S.;.{...|fi'.6U..n.......P...j:mH8<....V..U..rW......|.T.c6..,.....Unm&......I'...^......{.).0P.f..."0.-Q.*L..e..ThM.p9..:....gd+K.i..Z...v.*.J.O.q...~..+Tcv.Q...v..{.Y .....5.4..z9R@.f%.}.1.+..8.[^..^.....q.S#...!...=..RC....i..y..0.q0J...,!.p..\7.W.......M_.e.t..>....U.F...@..}.M.o.VU.dI.q=F_.~...i...D...+*)h.yV.J}8....Y..K.&f.Qi...A..+.. .....Z...sdc......mm.....d...w...@...4:...l...5..n....6cv....v.....7m."j..2.9...LD.-.48%_....aq....|..]..o.i..j..IdZ..P..N.H.......yv...O...4x....*E}..~...%..d.L...^^\..@....#5..I\.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate9.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144398
                                                                        Entropy (8bit):7.998746416087654
                                                                        Encrypted:true
                                                                        SSDEEP:3072:idUA0s+yrvoBR9DHPyVBCSs5RLCRzSo26ah+7NPfaAyxm/W7lMbZs0:PUvohDHEBCSe1CRm8BPfaAPcC9
                                                                        MD5:0024285EE16DA39920B2F468C04D01FC
                                                                        SHA1:E083E6DDE912A8B43C43A2A9F537B5FA9E24EDE9
                                                                        SHA-256:F21F7800422884D74F4BE36390C3B3A6DB604DB77C9EC65D8BC156571B0CEA7B
                                                                        SHA-512:68F071FFA7EF3DC560B1AADE65E7731E00D2F7EDD993F2D32B0FF3DDDB82AF5B95795C7AFD0B0A58D7D005DE4890B654748557D31F49707515C91992C720193D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.......T....,..1...eh....KWp..BV...c...+...>...bsh..."/............O/..p..\.9.....R!...,Lf.Lk;..@.!..[......f.P.<.".........N........@.....^.......U*m...2-...E#..xL........x../.V..A.O.........lk._.eA...D..}@`7._..w.....s.....xuI.?..|'..aI.)..1..........P.......c.lX.g...=#..t.n.1.Y...\.....K....|...b...o`...t.g.-@..In.......F......S...!...{. zf..)(B.....>z.tU..={1."^..&I$..<`F.lr.F|..?../V......y....DL..~..^..Zh"X.A..SVb.i...."...C...=M....3.7B.v(...5.V..l..1ZI..x5Ip.N..6(.OE...Q..u,.=..0........V..'.x...^a...X.[.....%w.Ev.A...J*.....3.......e.R..z.._.+.VV.[.W.n..O@)......L..3..{. ......I..n...J~f.,.}}.nGPKs..*:..+A..u.9..O...m...D.dJ}...[.0.PH.U.2.?!.^..3..x...TN>...*..%;...bR.[...1..A.i!<.9D...ES.2.L.38..W.....}..j....x.Q..yY..../5c.^p02......&..W.s..<..4.^E..&....^{..D..].j(.Y.U]p..z.6.:.i....).(0...6:...l..L..|........f..: .e...13...W..X3D...U.l.<...\....7.dN6.Z,&.Z.yW_.....Q"h|..o.&'?..NM....%....\_...}L'JbY...........X.q3.|".vOc.p...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Rotate9.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144398
                                                                        Entropy (8bit):7.998746416087654
                                                                        Encrypted:true
                                                                        SSDEEP:3072:idUA0s+yrvoBR9DHPyVBCSs5RLCRzSo26ah+7NPfaAyxm/W7lMbZs0:PUvohDHEBCSe1CRm8BPfaAPcC9
                                                                        MD5:0024285EE16DA39920B2F468C04D01FC
                                                                        SHA1:E083E6DDE912A8B43C43A2A9F537B5FA9E24EDE9
                                                                        SHA-256:F21F7800422884D74F4BE36390C3B3A6DB604DB77C9EC65D8BC156571B0CEA7B
                                                                        SHA-512:68F071FFA7EF3DC560B1AADE65E7731E00D2F7EDD993F2D32B0FF3DDDB82AF5B95795C7AFD0B0A58D7D005DE4890B654748557D31F49707515C91992C720193D
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.......T....,..1...eh....KWp..BV...c...+...>...bsh..."/............O/..p..\.9.....R!...,Lf.Lk;..@.!..[......f.P.<.".........N........@.....^.......U*m...2-...E#..xL........x../.V..A.O.........lk._.eA...D..}@`7._..w.....s.....xuI.?..|'..aI.)..1..........P.......c.lX.g...=#..t.n.1.Y...\.....K....|...b...o`...t.g.-@..In.......F......S...!...{. zf..)(B.....>z.tU..={1."^..&I$..<`F.lr.F|..?../V......y....DL..~..^..Zh"X.A..SVb.i...."...C...=M....3.7B.v(...5.V..l..1ZI..x5Ip.N..6(.OE...Q..u,.=..0........V..'.x...^a...X.[.....%w.Ev.A...J*.....3.......e.R..z.._.+.VV.[.W.n..O@)......L..3..{. ......I..n...J~f.,.}}.nGPKs..*:..+A..u.9..O...m...D.dJ}...[.0.PH.U.2.?!.^..3..x...TN>...*..%;...bR.[...1..A.i!<.9D...ES.2.L.38..W.....}..j....x.Q..yY..../5c.^p02......&..W.s..<..4.^E..&....^{..D..].j(.Y.U]p..z.6.:.i....).(0...6:...l..L..|........f..: .e...13...W..X3D...U.l.<...\....7.dN6.Z,&.Z.yW_.....Q"h|..o.&'?..NM....%....\_...}L'JbY...........X.q3.|".vOc.p...

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Save.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):126882
                                                                        Entropy (8bit):7.998420050109678
                                                                        Encrypted:true
                                                                        SSDEEP:3072:+83O476A1VJzAO6wuSPyImjG23lAojLZc+HGm:+8+66A1z0OLuKmjH36oj9HHP
                                                                        MD5:11033820BE65EC99451510C4C8D0EA11
                                                                        SHA1:03908A05DD48BA5E13094551F8A6C908B53754FA
                                                                        SHA-256:9F69FDE8B03395F5F06A6D1FD6828F0F115A94EE33E9F944414562C5F7F418DE
                                                                        SHA-512:565ECF671D088737432B3C9B0B0445DE7EC887ADBCAB150FFC721D6DB01DC099324D2F90A0E170B07D2C8823E1B0B7BE20A37560DD5B9F774060536815841DCF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.......4..U.... .tDCm.4..U.{u1....V.N}..Q{..sf..a....W..LSn..F..(.xwL..@.N.>FN........L.....j\........;.k..#V.......?A.,."........U..H;..L..../..7..Qn2.Q.zmj..l\..>...Q6....Yv.x`#3....@'N.G]Sn.j\...Q.@..M....s)......=K$.D....b.^{8..E....i.oY..&jA..>9.2..>.9...D.v.y...g.|.#...K].`v......_...F..hv.PE\l%.M.gl.&]hr...a...j..._..h..N..F...D..M....w..X....*.@..L`f..[.+..;......9.0.%...'.......sY.z....r.........O.\..........p........2.vx.f.....*..3l=..2.S.,..;$5H}$=...`.Vs..../...v........B.....gE...~...6.b66.D .g...Y.....\gRo[~...t^.<..v.).....k..?U.i.H..r1..@..X.$P.LR.6P..6.B~'.X.....yd..#...,.<.._.......p.2...M..Vq...R..].R....JS2]......m.?\.+;.t...K.P....E...F_...=G.$)..<../.q.......f.s,..n.l.b.[.K._w.hX,....`......vf.....Eh.x.....G.vQ..AB..).Hbs.u2).-..e_.........(bR,4T....V..?.....`L~...h.u~Q.....p.5..$...6d..@`..:.--r...l.vr.G..n..:.p..b.!.qg....;.h.0K.3.JJ.L.~}...s.<....qe.3O2......k.s,O.^..b......(..I\0..e.f.).m.&..U..8.4.m.~..Ds}..:.Q...m..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Save.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):126882
                                                                        Entropy (8bit):7.998420050109678
                                                                        Encrypted:true
                                                                        SSDEEP:3072:+83O476A1VJzAO6wuSPyImjG23lAojLZc+HGm:+8+66A1z0OLuKmjH36oj9HHP
                                                                        MD5:11033820BE65EC99451510C4C8D0EA11
                                                                        SHA1:03908A05DD48BA5E13094551F8A6C908B53754FA
                                                                        SHA-256:9F69FDE8B03395F5F06A6D1FD6828F0F115A94EE33E9F944414562C5F7F418DE
                                                                        SHA-512:565ECF671D088737432B3C9B0B0445DE7EC887ADBCAB150FFC721D6DB01DC099324D2F90A0E170B07D2C8823E1B0B7BE20A37560DD5B9F774060536815841DCF
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.......4..U.... .tDCm.4..U.{u1....V.N}..Q{..sf..a....W..LSn..F..(.xwL..@.N.>FN........L.....j\........;.k..#V.......?A.,."........U..H;..L..../..7..Qn2.Q.zmj..l\..>...Q6....Yv.x`#3....@'N.G]Sn.j\...Q.@..M....s)......=K$.D....b.^{8..E....i.oY..&jA..>9.2..>.9...D.v.y...g.|.#...K].`v......_...F..hv.PE\l%.M.gl.&]hr...a...j..._..h..N..F...D..M....w..X....*.@..L`f..[.+..;......9.0.%...'.......sY.z....r.........O.\..........p........2.vx.f.....*..3l=..2.S.,..;$5H}$=...`.Vs..../...v........B.....gE...~...6.b66.D .g...Y.....\gRo[~...t^.<..v.).....k..?U.i.H..r1..@..X.$P.LR.6P..6.B~'.X.....yd..#...,.<.._.......p.2...M..Vq...R..].R....JS2]......m.?\.+;.t...K.P....E...F_...=G.$)..<../.q.......f.s,..n.l.b.[.K._w.hX,....`......vf.....Eh.x.....G.vQ..AB..).Hbs.u2).-..e_.........(bR,4T....V..?.....`L~...h.u~Q.....p.5..$...6d..@`..:.--r...l.vr.G..n..:.p..b.!.qg....;.h.0K.3.JJ.L.~}...s.<....qe.3O2......k.s,O.^..b......(..I\0..e.f.).m.&..U..8.4.m.~..Ds}..:.Q...m..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Setup.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):126580
                                                                        Entropy (8bit):7.998637748249718
                                                                        Encrypted:true
                                                                        SSDEEP:1536:RRQnNrHm92MkRU9sFVi48JprgPZ6UPgxu/VyRwRAen8u21vXuOiOAY2Ui56JUAnP:wnNb97VI5onSRx9u2123OPW6qWoJW
                                                                        MD5:2B86CF58FE71F13D48AC4435729F02D8
                                                                        SHA1:5844A2C5E427BA8257CD74953B8E4A690152AE78
                                                                        SHA-256:78BF16E482A909E287C115CBA74EC76F967ECBF6A87C0DC55C6B2C4EB0BFA523
                                                                        SHA-512:5C626EB71A59CA75C3863E5F94091D0C2F6BB6119FCBE48E117C2AD05EDDFF9AACBF5D2D196230A640B87FFC5EFA9A37DB7461D833642E43E57A4B48A7395F4A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.........;]..6A.SY....%h...7.8.P...oFp..YY..<.4....{.~0~,..2..p.pM......UL.b.7.2....r..^.N;...T;|....'jZ!........F.#...d@....i.8.Rf..E...C#.......i.q;.o...h...:....r!....=....WDx...X9@...-.....6...2.!.Jg6..C.YY6Y.......o...O..2"l^7.Q7......+K..#...AuACU.e..5..s.Y.Bt.G.."....k$..1<..w<S.........[y..T.I.L7K..V!.d..*+q'..;..kb..K}.y.\$.....*.....v^..2..X......hW........V.::......K....8B..e.....H..xG..\......7...J:...\...."..S....~F..z.2. $!.k.."<...e..i......6..W...."D.....X...[E......c....O......./?.k..y.........R..*....5.:..)A./TX.C....M9.f}...G....Ef.&%mk.<....O:.....+.......O..n.o.+)..P.*n..5K.....x..N../3...j.|Cw...<....WClN...{r..p"..x.-\..+.......{..a.kr...'m.D...jr.;..v.V...%Z['.........i..2G...`...2.L..#..YL..%.._.e..R...F..L.#...a.8[l...N....16E....,.....|7b6 7...w.....H._.~..Q.B!%..6;.+..2p.~....w..}....'i;(.wrM...v..Y9.qmRX:Ngk...h.t(#.....=Kc.....L`0..#.JS....YY...........`...O0;J....&.o...Tz...6.>..%.f4....,.....#..'.`T.).7..Yq

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\Setup.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):126580
                                                                        Entropy (8bit):7.998637748249718
                                                                        Encrypted:true
                                                                        SSDEEP:1536:RRQnNrHm92MkRU9sFVi48JprgPZ6UPgxu/VyRwRAen8u21vXuOiOAY2Ui56JUAnP:wnNb97VI5onSRx9u2123OPW6qWoJW
                                                                        MD5:2B86CF58FE71F13D48AC4435729F02D8
                                                                        SHA1:5844A2C5E427BA8257CD74953B8E4A690152AE78
                                                                        SHA-256:78BF16E482A909E287C115CBA74EC76F967ECBF6A87C0DC55C6B2C4EB0BFA523
                                                                        SHA-512:5C626EB71A59CA75C3863E5F94091D0C2F6BB6119FCBE48E117C2AD05EDDFF9AACBF5D2D196230A640B87FFC5EFA9A37DB7461D833642E43E57A4B48A7395F4A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.........;]..6A.SY....%h...7.8.P...oFp..YY..<.4....{.~0~,..2..p.pM......UL.b.7.2....r..^.N;...T;|....'jZ!........F.#...d@....i.8.Rf..E...C#.......i.q;.o...h...:....r!....=....WDx...X9@...-.....6...2.!.Jg6..C.YY6Y.......o...O..2"l^7.Q7......+K..#...AuACU.e..5..s.Y.Bt.G.."....k$..1<..w<S.........[y..T.I.L7K..V!.d..*+q'..;..kb..K}.y.\$.....*.....v^..2..X......hW........V.::......K....8B..e.....H..xG..\......7...J:...\...."..S....~F..z.2. $!.k.."<...e..i......6..W...."D.....X...[E......c....O......./?.k..y.........R..*....5.:..)A./TX.C....M9.f}...G....Ef.&%mk.<....O:.....+.......O..n.o.+)..P.*n..5K.....x..N../3...j.|Cw...<....WClN...{r..p"..x.-\..+.......{..a.kr...'m.D...jr.;..v.V...%Z['.........i..2G...`...2.L..#..YL..%.._.e..R...F..L.#...a.8[l...N....16E....,.....|7b6 7...w.....H._.~..Q.B!%..6;.+..2p.~....w..}....'i;(.wrM...v..Y9.qmRX:Ngk...h.t(#.....=Kc.....L`0..#.JS....YY...........`...O0;J....&.o...Tz...6.>..%.f4....,.....#..'.`T.).7..Yq

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqMet.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):136647
                                                                        Entropy (8bit):7.998885945522583
                                                                        Encrypted:true
                                                                        SSDEEP:3072:b0cWKcj8DFfNY/vTDrNAI/wVn6+TKPBR0Tx:AcWKcj8JlY/rDrNAD8mMTux
                                                                        MD5:485AEC8E9B8049F9BE296FA02FBEFDEC
                                                                        SHA1:8F0125C9F850BBD9B54DC13172ED1309B6EF26E3
                                                                        SHA-256:B97B9AA65B3CC528191DA3435E89BA319EABEAB6C47721F8EECAD824FE0E2BA5
                                                                        SHA-512:FDD35069AA1209395B9B350DABD6FE4892941062EC25935A4D568AA6C34EDBB382CE5AFC86442D24DD156E39BB5B8295158B8D19D270E81CCABD4C19EF6835B5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:......w.....x?.FN..S".A-...2....Z.sp..M...8..`3..N.....S...G.u.........K|...Kv1....oL>.._.g..g...........n.Yd..r........M......g..D~...."......+C....\Kjp..Is.W....J.(HL...X.Z..8...*q.k.....|b.Y.+.?..FS"o.l....d.<.."EBu+RB/.....0E1......a*......../......m..(.0~.....YK...V7l...Ug_.m.r...4..................d)Q.HM[....Y....*.a..)..>....1.K..T..x6S.Q.....F;..<...o)..0.5.J,..S.,R../D.4xc......(u...%S.5....Y..L..!.y.K.A.n...X2.Y2.....E%g.....c.l....L.......z.s.H.R.a.Q...+...kv..4p@......N.....>O..+..V.....A...[LP.g....@..Z.877.0N.}.....i"....?.(.........$...q.h.@...5.q`0:Jc.G@.fL3..C.Nb...Wy...S....uvJ. .f.........3.;0...o.1`Q...=n\.~.._...l.Q/....tr-#9j.vPg..W,...(.9..53......to.V..........h.N..X..7..Y..u.G.....h...^..n.l..*.^.R9..U..A . .......6_.n...h...`..K`*..HJ......J.^....N...u..3h.t)./..xB.__..7....j...?8..g..jU...P...&.M..pk ..1..Gcp..k..."..9.D..,{.ECB.o..j...?..k...3.......a.bOl..(Cm..%...X>.q...v.t..'.....$....d..@.%...m{."V.....l.KO.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqMet.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):136647
                                                                        Entropy (8bit):7.998885945522583
                                                                        Encrypted:true
                                                                        SSDEEP:3072:b0cWKcj8DFfNY/vTDrNAI/wVn6+TKPBR0Tx:AcWKcj8JlY/rDrNAD8mMTux
                                                                        MD5:485AEC8E9B8049F9BE296FA02FBEFDEC
                                                                        SHA1:8F0125C9F850BBD9B54DC13172ED1309B6EF26E3
                                                                        SHA-256:B97B9AA65B3CC528191DA3435E89BA319EABEAB6C47721F8EECAD824FE0E2BA5
                                                                        SHA-512:FDD35069AA1209395B9B350DABD6FE4892941062EC25935A4D568AA6C34EDBB382CE5AFC86442D24DD156E39BB5B8295158B8D19D270E81CCABD4C19EF6835B5
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:......w.....x?.FN..S".A-...2....Z.sp..M...8..`3..N.....S...G.u.........K|...Kv1....oL>.._.g..g...........n.Yd..r........M......g..D~...."......+C....\Kjp..Is.W....J.(HL...X.Z..8...*q.k.....|b.Y.+.?..FS"o.l....d.<.."EBu+RB/.....0E1......a*......../......m..(.0~.....YK...V7l...Ug_.m.r...4..................d)Q.HM[....Y....*.a..)..>....1.K..T..x6S.Q.....F;..<...o)..0.5.J,..S.,R../D.4xc......(u...%S.5....Y..L..!.y.K.A.n...X2.Y2.....E%g.....c.l....L.......z.s.H.R.a.Q...+...kv..4p@......N.....>O..+..V.....A...[LP.g....@..Z.877.0N.}.....i"....?.(.........$...q.h.@...5.q`0:Jc.G@.fL3..C.Nb...Wy...S....uvJ. .f.........3.;0...o.1`Q...=n\.~.._...l.Q/....tr-#9j.vPg..W,...(.9..53......to.V..........h.N..X..7..Y..u.G.....h...^..n.l..*.^.R9..U..A . .......6_.n...h...`..K`*..HJ......J.^....N...u..3h.t)./..xB.__..7....j...?8..g..jU...P...&.M..pk ..1..Gcp..k..."..9.D..,{.ECB.o..j...?..k...3.......a.bOl..(Cm..%...X>.q...v.t..'.....$....d..@.%...m{."V.....l.KO.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqNotMet.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144324
                                                                        Entropy (8bit):7.9985949349849275
                                                                        Encrypted:true
                                                                        SSDEEP:3072:JSZS6w/9AE3cO9ylaZ3TFkZhH2ppeAnsrEwc/ar0Q5drlxx:JSZu/eE793DWWveesreaD5drbx
                                                                        MD5:87CE485DFCB418637F7258D8F83A3273
                                                                        SHA1:FBDA6955A1C1C5692BA5BF8F540BC576B34EF627
                                                                        SHA-256:8F7F927B43A0E63D60B54A92FD7F9FF258ECD9CC661C980E75023E0A13DC5A47
                                                                        SHA-512:DF72768F2FE95BFCAE2A51B48FB20E0C164A3AD2CBE57C6409CE223E352515B24A7939A752472EDF9E33BA877E2E76DEE21CCA9E7279C513A6763510BED73CE4
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....xS....^....8."y....9..GSH.Ok...[.z"L..l.<..p"..5.....*.s..(...,.^2>.cv&..q.....q..zN.#.f...U..)..>.+....o.....g`.$.!.>.{...........XM..x.N./+&.g$...I.7...yP...._i..{...sj]YL.....d.l..?'.f.0?...)....@\.e^..9..e3..:nR67......)..(e....|..2...Y0S...`vy.#..[c.cX.. .!.D..)\..q.'.v..B.)x.AG5xyc..x.#7....&...M.>.0.^.4WN<i...-...u....W;. ....Z.6,...u~.w..?..T8.....A..q.....Z... ...w.... .f%Z.n\.%....W3"............kB.\..]....pTYL.....)..0...L5..X6..}.t....QsXm.dd..]...(..~.G....7.4.N..........5'.y.d.z.."....G....B..(..d.. .3.....n~......t0....l...*...J..}0...........W..".Ji....O.L...u.r .......nqi..8srs....`...'.-+.b.p....K...0....c.....s,..-.s.p...(.....x..t..K...X+Y.E.!.t...\..?....c...I.......02!.E.... k...z..v...........>.&......l..p5Y..-Z...?.z..).S....S5...W.D8..=SU...Y .].N...}~..{!d.1>.J3..-.+.+.#.]-.8?.*....</8......8.[.^.......(...=.t...{..(w..........~:5)~...y......|..bt..1...8+D...=.....lM4..O....c$V.....,..s.TR.!{.C.....$..pj...."'

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\SysReqNotMet.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):144324
                                                                        Entropy (8bit):7.9985949349849275
                                                                        Encrypted:true
                                                                        SSDEEP:3072:JSZS6w/9AE3cO9ylaZ3TFkZhH2ppeAnsrEwc/ar0Q5drlxx:JSZu/eE793DWWveesreaD5drbx
                                                                        MD5:87CE485DFCB418637F7258D8F83A3273
                                                                        SHA1:FBDA6955A1C1C5692BA5BF8F540BC576B34EF627
                                                                        SHA-256:8F7F927B43A0E63D60B54A92FD7F9FF258ECD9CC661C980E75023E0A13DC5A47
                                                                        SHA-512:DF72768F2FE95BFCAE2A51B48FB20E0C164A3AD2CBE57C6409CE223E352515B24A7939A752472EDF9E33BA877E2E76DEE21CCA9E7279C513A6763510BED73CE4
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:.....xS....^....8."y....9..GSH.Ok...[.z"L..l.<..p"..5.....*.s..(...,.^2>.cv&..q.....q..zN.#.f...U..)..>.+....o.....g`.$.!.>.{...........XM..x.N./+&.g$...I.7...yP...._i..{...sj]YL.....d.l..?'.f.0?...)....@\.e^..9..e3..:nR67......)..(e....|..2...Y0S...`vy.#..[c.cX.. .!.D..)\..q.'.v..B.)x.AG5xyc..x.#7....&...M.>.0.^.4WN<i...-...u....W;. ....Z.6,...u~.w..?..T8.....A..q.....Z... ...w.... .f%Z.n\.%....W3"............kB.\..]....pTYL.....)..0...L5..X6..}.t....QsXm.dd..]...(..~.G....7.4.N..........5'.y.d.z.."....G....B..(..d.. .3.....n~......t0....l...*...J..}0...........W..".Ji....O.L...u.r .......nqi..8srs....`...'.-+.b.p....K...0....c.....s,..-.s.p...(.....x..t..K...X+Y.E.!.t...\..?....c...I.......02!.E.... k...z..v...........>.&......l..p5Y..-Z...?.z..).S....S5...W.D8..=SU...Y .].N...}~..{!d.1>.J3..-.+.+.#.]-.8?.*....</8......8.[.^.......(...=.t...{..(w..........~:5)~...y......|..bt..1...8+D...=.....lM4..O....c$V.....,..s.TR.!{.C.....$..pj...."'

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\stop.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):190533
                                                                        Entropy (8bit):7.5921795740075675
                                                                        Encrypted:false
                                                                        SSDEEP:3072:Ee5tAukvR2rRn1gda6WuutNrQjgfXeCdgP0ucnf+s9+A/nvrHmNejlGYlE:EeIrZ29Gd/kogf2PvI+s9jj8ejFE
                                                                        MD5:FF45D68555F87D3BC8C3D8119109264D
                                                                        SHA1:EF1EFA954A51A8294662C2E24B2B55B082171A50
                                                                        SHA-256:170AA63DD0F7E6B2FDC7E632B80B238AF72F51F4AAFB50B7F0B3302C5D701BF7
                                                                        SHA-512:91C23EF82AF3D9E1AF779AE9130C090033BE4A0408FEEE8A6CC203A7AAF61F9A5CAAC5022C3299023FB17042DDB205DA8A60E56B09D74FE0E9609362F9D986AD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:....$'.v.+.I.....}.....k....5&.9ut..O....H.T-.A8.9..{>..^...`v..{.w-E..W.c..P......QLRR...........P<..#Z..y.V..4...5{H.......>..f.{.u....~...K.@.@.Ht..4.m.,:vv.J.......h..s....|....^^?F ...$..,......?..../Y2c..........R^...Qd...@.h5.m...Hda.pge..P.c.:(....Mq+.....~ur.UK..k.j.U........O..QW.J1....J.J...+.$9....<'....P...)d.y.Ty..<(...e..U...h.h..)....."...$y.f.....X.M..H.+.v m..@SPZ.. V.O.U....@.=r...Z..#..3.=..X..`...qz.6.~(.!.K.b......\.FE.8Dx.....a9.;.EQ..+(.].C..U..Z.M.w..63M.....R..{...yc.0...p..Va..V.......t........>.D.#Dg.)...-...7l.).g........(.~......S..h..v.c.Wa.S#..WfRY:....DXk....9.....d.z.Aj.)A.9.c.4.\.)..........cf.Y.E.>..Z[..1.d..(.[....:R..'....9Mp$v@..WlL.`...."...s......%B...G........5*I.O.}.....I..:.@..$v..?....'..$.;v!:V8.........X.._/....H...../.Hj.vo...n.pJ..2I...............u.....G.A.....O...:R.........y...d.d...y...././.?+uf._....9.f....$t.....-v.z.S..8..t.9<.<.n.....VN.#U4.5..D.....)./.....V...Q....t.+.=..5...*..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\stop.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):190533
                                                                        Entropy (8bit):7.5921795740075675
                                                                        Encrypted:false
                                                                        SSDEEP:3072:Ee5tAukvR2rRn1gda6WuutNrQjgfXeCdgP0ucnf+s9+A/nvrHmNejlGYlE:EeIrZ29Gd/kogf2PvI+s9jj8ejFE
                                                                        MD5:FF45D68555F87D3BC8C3D8119109264D
                                                                        SHA1:EF1EFA954A51A8294662C2E24B2B55B082171A50
                                                                        SHA-256:170AA63DD0F7E6B2FDC7E632B80B238AF72F51F4AAFB50B7F0B3302C5D701BF7
                                                                        SHA-512:91C23EF82AF3D9E1AF779AE9130C090033BE4A0408FEEE8A6CC203A7AAF61F9A5CAAC5022C3299023FB17042DDB205DA8A60E56B09D74FE0E9609362F9D986AD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:....$'.v.+.I.....}.....k....5&.9ut..O....H.T-.A8.9..{>..^...`v..{.w-E..W.c..P......QLRR...........P<..#Z..y.V..4...5{H.......>..f.{.u....~...K.@.@.Ht..4.m.,:vv.J.......h..s....|....^^?F ...$..,......?..../Y2c..........R^...Qd...@.h5.m...Hda.pge..P.c.:(....Mq+.....~ur.UK..k.j.U........O..QW.J1....J.J...+.$9....<'....P...)d.y.Ty..<(...e..U...h.h..)....."...$y.f.....X.M..H.+.v m..@SPZ.. V.O.U....@.=r...Z..#..3.=..X..`...qz.6.~(.!.K.b......\.FE.8Dx.....a9.;.EQ..+(.].C..U..Z.M.w..63M.....R..{...yc.0...p..Va..V.......t........>.D.#Dg.)...-...7l.).g........(.~......S..h..v.c.Wa.S#..WfRY:....DXk....9.....d.z.Aj.)A.9.c.4.\.)..........cf.Y.E.>..Z[..1.d..(.[....:R..'....9Mp$v@..WlL.`...."...s......%B...G........5*I.O.}.....I..:.@..$v..?....'..$.;v!:V8.........X.._/....H...../.Hj.vo...n.pJ..2I...............u.....G.A.....O...:R.........y...d.d...y...././.?+uf._....9.f....$t.....-v.z.S..8..t.9<.<.n.....VN.#U4.5..D.....)./.....V...Q....t.+.=..5...*..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\warn.ico

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):199675
                                                                        Entropy (8bit):7.324698059271332
                                                                        Encrypted:false
                                                                        SSDEEP:3072:zi9oNo4KxbrvjPwQCQzkkfLfCsEtGlZXXnjwrjZyOXtG+MCIeDG44:zxybrvFLfXEElhTwRyOXtO5e4
                                                                        MD5:10DF9109FE86200F4E81946ECF012044
                                                                        SHA1:A1AED4527E385587DFF8FF822043234D3212F599
                                                                        SHA-256:F81059A50E1C5763B21FFE496B693F2C60F9D97C0DCD2D39C777114483C8C60D
                                                                        SHA-512:5C54111B87E5E5C692B778A4508A172BBABA744786FA49C4E6A2AFE0B002BF11D93D4FE4A3CA5BF89281B342167863B39ABE07B2FD8C41AD64D55A7E2B740F80
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:....$.?c.].)..|.K..Y thP`.Z.....z./.X.......jqQD.Za.pA..b.07...........E....3..<......9...de..++..q..[.:.\.#...=}..........Nxp{1...j...@k;.t..hU.P.C...>k\bpK...eU....Z.l..2....^..v.....j..W.e....Y....Q;G...*.s..ML%#.f....D`E-..........$Ej.M..t..s...."Xc3...-.+c......0.4w7`y......j.W.|..~..]d|.&........k..uq....GH....u`..F.B+.?.....)....9D....T$.4 .O.p...B..jJp.c...@....V.U....k..M....K..E..YBg..+...?.9{\H...%...H].7wj.t'.pb..hn.....r..dd......4(...N..J..G..t"........=...5"D.W.:n H)d....E......5'.w....r.....)....~...d-..B.......c...g.C..1#9..r.....o........ .K<6.S|L...,2...f...R.!Q.p......-./Ws..53..w.....T5'..Zbc.w.6.}\'.)>.O.Kw...GH=.cYtI.F..s....!...`a.a.%j.A..v......!X..\..s.....E.".c.o.[....pD._]...`.;...`..L.G....`.V...`.!..|fWD...a......m.8U........J.#..X..vh...J.J...;.n.8.<...g....>|.@..B+...rI{1;t.7G..nb.N....|....2..[. ......<}.y....Y.\.5.=...,yI..+..c.p..V...n..@.{]....j..A..{..@....&......T....."..:0.......TC.!...;.[.6.51.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Graphics\warn.ico.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):199675
                                                                        Entropy (8bit):7.324698059271332
                                                                        Encrypted:false
                                                                        SSDEEP:3072:zi9oNo4KxbrvjPwQCQzkkfLfCsEtGlZXXnjwrjZyOXtG+MCIeDG44:zxybrvFLfXEElhTwRyOXtO5e4
                                                                        MD5:10DF9109FE86200F4E81946ECF012044
                                                                        SHA1:A1AED4527E385587DFF8FF822043234D3212F599
                                                                        SHA-256:F81059A50E1C5763B21FFE496B693F2C60F9D97C0DCD2D39C777114483C8C60D
                                                                        SHA-512:5C54111B87E5E5C692B778A4508A172BBABA744786FA49C4E6A2AFE0B002BF11D93D4FE4A3CA5BF89281B342167863B39ABE07B2FD8C41AD64D55A7E2B740F80
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:....$.?c.].)..|.K..Y thP`.Z.....z./.X.......jqQD.Za.pA..b.07...........E....3..<......9...de..++..q..[.:.\.#...=}..........Nxp{1...j...@k;.t..hU.P.C...>k\bpK...eU....Z.l..2....^..v.....j..W.e....Y....Q;G...*.s..ML%#.f....D`E-..........$Ej.M..t..s...."Xc3...-.+c......0.4w7`y......j.W.|..~..]d|.&........k..uq....GH....u`..F.B+.?.....)....9D....T$.4 .O.p...B..jJp.c...@....V.U....k..M....K..E..YBg..+...?.9{\H...%...H].7wj.t'.pb..hn.....r..dd......4(...N..J..G..t"........=...5"D.W.:n H)d....E......5'.w....r.....)....~...d-..B.......c...g.C..1#9..r.....o........ .K<6.S|L...,2...f...R.!Q.p......-./Ws..53..w.....T5'..Zbc.w.6.}\'.)>.O.Kw...GH=.cYtI.F..s....!...`a.a.%j.A..v......!X..\..s.....E.".c.o.[....pD._]...`.;...`..L.G....`.V...`.!..|fWD...a......m.8U........J.#..X..vh...J.J...;.n.8.<...g....>|.@..B+...rI{1;t.7G..nb.N....|....2..[. ......<}.y....Y.\.5.=...,yI..+..c.p..V...n..@.{]....j..A..{..@....&......T....."..:0.......TC.!...;.[.6.51.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\ParameterInfo.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):2792532
                                                                        Entropy (8bit):4.169925294927217
                                                                        Encrypted:false
                                                                        SSDEEP:6144:VFztXjyZwKSX7el8oRBRiWhyHMJQVH1fAyGygL+MsS:LzN0wK27c8oRn11ygL+Mp
                                                                        MD5:36299C6FEDA81EB41CD173B8026A276D
                                                                        SHA1:E518D62BE21BC75A6E8D5B8D0B6058A06E97DE87
                                                                        SHA-256:AF7D87C0BB8F4315E3C99D402AB5FD2AF65BD9ECF562547995108DE09C685879
                                                                        SHA-512:14C9605481AF94FF02042B9D1F9EB7A2DA1A5F1EDF17EEA7944FC75EB1118082CBFB67916AB0EAA2FFF8705AE06131FE67D411E6655703487875E71C5195D37B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:..<.?rD.Be......5r(.l.b.........'."k..2%{......Q\....p.C(..6.G..d.U.........Y....A.%.W".C4....A..5#zo..v....Cd...H_..nq.XR.R..8...5W..UF@..v"...d.jw...;.kt.f...Od....&t.H.'../.|.d..WW..Ct.I..&k/...i.B.RPG\E...._j......OK.80..,.C$#m(_h *O..=sG..|...A]...L..g..K...!.Q.]...P.X..UB.M.&.. u.#.s.u...R>Rq.O/..?;KE..q.<.Z..e..r.+|9.7.M.%a:.......*..E..-.E.?...UQ...2.cd.G.D.....w..Geoc..2I.!..Y8...N.B........0t.uO....ucF.b.F|.X....~'.M0.W...zrPG.........<..[H..9...w.....ih^_...sND.r.5......R..|..h..9h.M...q...[M..LE..4w.e:...W.......*.]q..v.W5.jI._I{.l7...m.....O..x].....]$...._I9.Ag.1Nu.@Ihq..K5\I} v..x..D#.x.[.......G..|^5...S.f.-4.e.U....=&.......o.u.........._..^$...).3........w.....T.......Y&...v..a...s.. ..5.$.C.... ..7Y..$..2|......5....S[.n....+..S._cg._....K..z5r.O1.f .6.......5v.0F..s.Go..q.N..v.!E..\V<..h.H..`.R.`O./..9..-..#.+....}.B..[.5.Hp..U..{U../.NZ...f.Y.4.d...>.U.e.p.y..e^.......C.s..Q..*`7d..'$..Z^y....Z....x2.*....g.....Y..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\ParameterInfo.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):2792532
                                                                        Entropy (8bit):4.169925294927217
                                                                        Encrypted:false
                                                                        SSDEEP:6144:VFztXjyZwKSX7el8oRBRiWhyHMJQVH1fAyGygL+MsS:LzN0wK27c8oRn11ygL+Mp
                                                                        MD5:36299C6FEDA81EB41CD173B8026A276D
                                                                        SHA1:E518D62BE21BC75A6E8D5B8D0B6058A06E97DE87
                                                                        SHA-256:AF7D87C0BB8F4315E3C99D402AB5FD2AF65BD9ECF562547995108DE09C685879
                                                                        SHA-512:14C9605481AF94FF02042B9D1F9EB7A2DA1A5F1EDF17EEA7944FC75EB1118082CBFB67916AB0EAA2FFF8705AE06131FE67D411E6655703487875E71C5195D37B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:..<.?rD.Be......5r(.l.b.........'."k..2%{......Q\....p.C(..6.G..d.U.........Y....A.%.W".C4....A..5#zo..v....Cd...H_..nq.XR.R..8...5W..UF@..v"...d.jw...;.kt.f...Od....&t.H.'../.|.d..WW..Ct.I..&k/...i.B.RPG\E...._j......OK.80..,.C$#m(_h *O..=sG..|...A]...L..g..K...!.Q.]...P.X..UB.M.&.. u.#.s.u...R>Rq.O/..?;KE..q.<.Z..e..r.+|9.7.M.%a:.......*..E..-.E.?...UQ...2.cd.G.D.....w..Geoc..2I.!..Y8...N.B........0t.uO....ucF.b.F|.X....~'.M0.W...zrPG.........<..[H..9...w.....ih^_...sND.r.5......R..|..h..9h.M...q...[M..LE..4w.e:...W.......*.]q..v.W5.jI._I{.l7...m.....O..x].....]$...._I9.Ag.1Nu.@Ihq..K5\I} v..x..D#.x.[.......G..|^5...S.f.-4.e.U....=&.......o.u.........._..^$...).3........w.....T.......Y&...v..a...s.. ..5.$.C.... ..7Y..$..2|......5....S[.n....+..S._cg._....K..z5r.O1.f .6.......5v.0F..s.Go..q.N..v.!E..\V<..h.H..`.R.`O./..9..-..#.+....}.B..[.5.Hp..U..{U../.NZ...f.Y.4.d...>.U.e.p.y..e^.......C.s..Q..*`7d..'$..Z^y....Z....x2.*....g.....Y..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Setup.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):123094
                                                                        Entropy (8bit):7.998396235857768
                                                                        Encrypted:true
                                                                        SSDEEP:3072:WXNW4P2RVjjRV62OWOE/msffTFUI6Nz76OnTVEd:K0mEVjju2B+sXTqb7Zn2
                                                                        MD5:D9723ED3468CFFDAA3786042C9F26EBA
                                                                        SHA1:473D484A89261498FFC792507EE626C3C295E85F
                                                                        SHA-256:A47503C292A37C3E8275FCD0F1B571616FC9AF912B1CB3C138F7C4EBDF04FD36
                                                                        SHA-512:12707161698FA25FC666050B1EE8FFC48428B11966FE59A51CC6FF41095C08C07DBDC50DB9F1B1A9C6536AB61CFFFC5BF43E784147BB53E66643F55B0C985E56
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...Fnl.[.*....Jf..|."li.jdz...Vi6..4..?..#..n.H.L.O.$R.d,T@.......eT`E.q..5wr,..c...G...|.u.mJ.i...._..mR%]v7cMD.[....D4'B..cs.....2k.~..a...rQ..!..6.z'L........+...sRlx...S....0..4...T..r...a.l....i.......b..\w4@.D.."u;..~.9QH...?_.%.w..).......T....JJ.....[..i./..ko.c.s,.rq.v6 ..>X.L...p^....v./.|.a.$Ps..t......K...u!S;Q....L.R..x.D%g.C.....krk4;.eGk.p....Q....?..o....]>..Ebn:<v.M...OD#.m...T.... .#.UB.fK........LA.{&...+..G..CQ.L>..~.1...N...h...(1..;R~..a.........=C.3.Z.p[.5W.2Y.........e...f.......^]]........MJ3.....z.G*....E....9t9i.e.........?..3..x.h..]DayTj%..9..EIb....k.z.h.._C.'Bd.) _!.A".U.b....-o..[.t..ct9f...4..j.yRu.:..*...U..f....(:.#d.8..y'.K.t..I....M...?........^..K.X*E..I...T..........h.g8.F+#..{.......jAr.p..Y...o.....{...,%J............qK.O....<..wO.0..LO.p...;...o.r. 2H'....i4.y..P..xJL........TKB...._...E1..t...+..lZ."....v.Dv)..{...e..yw.j......o..:vDs.6...e............3.=..o..,..cv.QSp...=.SR+.c..a.5...2s"v_V

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Setup.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable, MZ for MS-DOS
                                                                        Category:dropped
                                                                        Size (bytes):123094
                                                                        Entropy (8bit):7.998396235857768
                                                                        Encrypted:true
                                                                        SSDEEP:3072:WXNW4P2RVjjRV62OWOE/msffTFUI6Nz76OnTVEd:K0mEVjju2B+sXTqb7Zn2
                                                                        MD5:D9723ED3468CFFDAA3786042C9F26EBA
                                                                        SHA1:473D484A89261498FFC792507EE626C3C295E85F
                                                                        SHA-256:A47503C292A37C3E8275FCD0F1B571616FC9AF912B1CB3C138F7C4EBDF04FD36
                                                                        SHA-512:12707161698FA25FC666050B1EE8FFC48428B11966FE59A51CC6FF41095C08C07DBDC50DB9F1B1A9C6536AB61CFFFC5BF43E784147BB53E66643F55B0C985E56
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ...Fnl.[.*....Jf..|."li.jdz...Vi6..4..?..#..n.H.L.O.$R.d,T@.......eT`E.q..5wr,..c...G...|.u.mJ.i...._..mR%]v7cMD.[....D4'B..cs.....2k.~..a...rQ..!..6.z'L........+...sRlx...S....0..4...T..r...a.l....i.......b..\w4@.D.."u;..~.9QH...?_.%.w..).......T....JJ.....[..i./..ko.c.s,.rq.v6 ..>X.L...p^....v./.|.a.$Ps..t......K...u!S;Q....L.R..x.D%g.C.....krk4;.eGk.p....Q....?..o....]>..Ebn:<v.M...OD#.m...T.... .#.UB.fK........LA.{&...+..G..CQ.L>..~.1...N...h...(1..;R~..a.........=C.3.Z.p[.5W.2Y.........e...f.......^]]........MJ3.....z.G*....E....9t9i.e.........?..3..x.h..]DayTj%..9..EIb....k.z.h.._C.'Bd.) _!.A".U.b....-o..[.t..ct9f...4..j.yRu.:..*...U..f....(:.#d.8..y'.K.t..I....M...?........^..K.X*E..I...T..........h.g8.F+#..{.......jAr.p..Y...o.....{...,%J............qK.O....<..wO.0..LO.p...;...o.r. 2H'....i4.y..P..xJL........TKB...._...E1..t...+..lZ."....v.Dv)..{...e..yw.j......o..:vDs.6...e............3.=..o..,..cv.QSp...=.SR+.c..a.5...2s"v_V

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\SetupUi.xsd

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):32906
                                                                        Entropy (8bit):7.99398242603785
                                                                        Encrypted:true
                                                                        SSDEEP:768:/l+yyor+zqS0onJ5rtIg1z4KKEEW195QBZ8PbjK8G/Msi:NoxFLragiIrsG2v0si
                                                                        MD5:8667AB39D52529DC0BCF5F6A9D5C0083
                                                                        SHA1:2164A17CB23E43A95F1CA43A802A4C807A39B8AB
                                                                        SHA-256:FFBC52F946CD614D96827E4DD70299A1B835D39E0A11ECB4D85E86E573A04326
                                                                        SHA-512:4E19852C5A7E1AE6A31E5F65EEB58247D15216EB68C2145459D2E01707CDC484D37EB36E1BAF52B31106347F84BBC30286FEA6DD5E380D5B6423A7DC0E84BE41
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:<?xml+.~....(.u..D.<{.n.. .%h.w.H.~.xx1.R&..[C........-.`v%.T.&i....&....(q6..d.y.6.8..Q/.=..C..;.0S....$.8...DM.r.<"....T...^.t......U..(t...9........<F.n.].ov.....7..j.?....i..n..,...V>.f...'.......S.75..:...Y.....H......}.....3".x.p.nB?.h|+..Cz.<..".l...%.wf...=..y...3.z..4.-....4.\.....P.D.q..5.zG......,.2^.(....je... ..crxl.?.r.8....;..M..THS.1i......fY..`x.w.<..Tq...*..H.....\K).!HJW..VC..L....[.tQ...g.].v....lgf.s...eY0..h)N..O^9C..s...ln...s.<Q.n9.d...&B.p[,I.Mf.......TA..uQ.........)G....?...K...O...........KD8..Y.,R...1.d..;...ZPY4.j.....\.\.T...3..{..,J...r...R.N..Z]..k..E...].g.r.~........2Y0.Y.D.... 7+...........:...."[>.oJ.w..Y.6o.^Q+.Z.L..)...c'..a.B.D..BI..;A...K....4.e..,.=...lkM.v.-,9...v.y.Z...r..D.X......h...&..?.....h.L...........B..H..KO.V1qU....2r.~V.K.Y....z.......4..|s-...L. .Q..D..<*..)Uk.r0}.`.."........&o..{T....._}.$.d.^O..e....y...!3..D!.H.8p..N..nT....D&.i.....n......?..x.....4.D.........E.V.;..S....H......k

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\SetupUi.xsd.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):32906
                                                                        Entropy (8bit):7.99398242603785
                                                                        Encrypted:true
                                                                        SSDEEP:768:/l+yyor+zqS0onJ5rtIg1z4KKEEW195QBZ8PbjK8G/Msi:NoxFLragiIrsG2v0si
                                                                        MD5:8667AB39D52529DC0BCF5F6A9D5C0083
                                                                        SHA1:2164A17CB23E43A95F1CA43A802A4C807A39B8AB
                                                                        SHA-256:FFBC52F946CD614D96827E4DD70299A1B835D39E0A11ECB4D85E86E573A04326
                                                                        SHA-512:4E19852C5A7E1AE6A31E5F65EEB58247D15216EB68C2145459D2E01707CDC484D37EB36E1BAF52B31106347F84BBC30286FEA6DD5E380D5B6423A7DC0E84BE41
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:<?xml+.~....(.u..D.<{.n.. .%h.w.H.~.xx1.R&..[C........-.`v%.T.&i....&....(q6..d.y.6.8..Q/.=..C..;.0S....$.8...DM.r.<"....T...^.t......U..(t...9........<F.n.].ov.....7..j.?....i..n..,...V>.f...'.......S.75..:...Y.....H......}.....3".x.p.nB?.h|+..Cz.<..".l...%.wf...=..y...3.z..4.-....4.\.....P.D.q..5.zG......,.2^.(....je... ..crxl.?.r.8....;..M..THS.1i......fY..`x.w.<..Tq...*..H.....\K).!HJW..VC..L....[.tQ...g.].v....lgf.s...eY0..h)N..O^9C..s...ln...s.<Q.n9.d...&B.p[,I.Mf.......TA..uQ.........)G....?...K...O...........KD8..Y.,R...1.d..;...ZPY4.j.....\.\.T...3..{..,J...r...R.N..Z]..k..E...].g.r.~........2Y0.Y.D.... 7+...........:...."[>.oJ.w..Y.6o.^Q+.Z.L..)...c'..a.B.D..BI..;A...K....4.e..,.=...lkM.v.-,9...v.y.Z...r..D.X......h...&..?.....h.L...........B..H..KO.V1qU....2r.~V.K.Y....z.......4..|s-...L. .Q..D..<*..)Uk.r0}.`.."........&o..{T....._}.$.d.^O..e....y...!3..D!.H.8p..N..nT....D&.i.....n......?..x.....4.D.........E.V.;..S....H......k

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\SetupUtility.exe

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):311702
                                                                        Entropy (8bit):7.662034243573179
                                                                        Encrypted:false
                                                                        SSDEEP:6144:YRSRyCx8SlumkBFgLfKw9tOk9z3uioNPHioqkpw:oSh8SlGBFGAk9loNKI6
                                                                        MD5:72BFB485E3ADA6D0A0ACBB176A59009C
                                                                        SHA1:E5B2789ACF8DCF51E233F0093CEC53629DDC2F5D
                                                                        SHA-256:74FA0D8C962BCA9D54F40C6ED97C240C062E2B93AE1643D73919C56782B396E9
                                                                        SHA-512:1292948C60B43F09A64FB076945938593EB985CB2AC62B6F50A580AFA4E7B597E725331CE1B5A482309DAC0A20B78B2644A63525E87DA8E0409FBA3284F24821
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......`...H.Q...@.]As..AJ.y....N..C..3......<.%u..^!M.0.....h...D.R.b{...f...{+{#%./C...~6......lt3@|<.m...6(...`.&..Gn'..X./.r..!E..|%lcQ.?.!..B..-+..p.vG.&&bU...t.8...a...$....].8...0..`....S.P....;...Cc.f.%..........Y..K.Z:/Y...b.~p..;...c.%d}+.....(-....p.9QjO.XgXjh......lP{y..gI. .X..b..H.>.Ps.....K..].$\..e.X...L.`2%....d3..M...k..].v..,j#...-..MR.~aD.%.,C..&O....p...*C..=..&`.......v....'. ^A..:8..U.... ...:...PA...<....N.n.Jg....>!..b..Y..g..x...-Qy...|.<...v..5&..R....._..l...{.z<7.FjL.0..*..>.....a}..{27...w.......$v....R.a.t........}.....Y.|..K.^.BX.5HO...|:RO.]..}.Y<mb..p..F...>..P.......pC....m.`5...R`...R...z6.rIiQ#...D.EI.PQ....N..%.Q....q..A....;P....en...6.....y.b.|.)O.Q........n.....w..$.p...+V.O...o......4....K...R..).......ko...u...O.;U5J\.V6g .9..Q.........b.m@..p.*1...t.fr...dg*._.8uhc.i;!.3. ..N.r..Y9a....2iC.y.x.J..q..H't.W.ha...Ep. l.B,oB..o..{.%.T....d%..m.3...&.YnUf...U..f...QB.4..Ty)tU..XO.Z]!........._7

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\SetupUtility.exe.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:MS-DOS executable
                                                                        Category:dropped
                                                                        Size (bytes):311702
                                                                        Entropy (8bit):7.662034243573179
                                                                        Encrypted:false
                                                                        SSDEEP:6144:YRSRyCx8SlumkBFgLfKw9tOk9z3uioNPHioqkpw:oSh8SlGBFGAk9loNKI6
                                                                        MD5:72BFB485E3ADA6D0A0ACBB176A59009C
                                                                        SHA1:E5B2789ACF8DCF51E233F0093CEC53629DDC2F5D
                                                                        SHA-256:74FA0D8C962BCA9D54F40C6ED97C240C062E2B93AE1643D73919C56782B396E9
                                                                        SHA-512:1292948C60B43F09A64FB076945938593EB985CB2AC62B6F50A580AFA4E7B597E725331CE1B5A482309DAC0A20B78B2644A63525E87DA8E0409FBA3284F24821
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:MZ......`...H.Q...@.]As..AJ.y....N..C..3......<.%u..^!M.0.....h...D.R.b{...f...{+{#%./C...~6......lt3@|<.m...6(...`.&..Gn'..X./.r..!E..|%lcQ.?.!..B..-+..p.vG.&&bU...t.8...a...$....].8...0..`....S.P....;...Cc.f.%..........Y..K.Z:/Y...b.~p..;...c.%d}+.....(-....p.9QjO.XgXjh......lP{y..gI. .X..b..H.>.Ps.....K..].$\..e.X...L.`2%....d3..M...k..].v..,j#...-..MR.~aD.%.,C..&O....p...*C..=..&`.......v....'. ^A..:8..U.... ...:...PA...<....N.n.Jg....>!..b..Y..g..x...-Qy...|.<...v..5&..R....._..l...{.z<7.FjL.0..*..>.....a}..{27...w.......$v....R.a.t........}.....Y.|..K.^.BX.5HO...|:RO.]..}.Y<mb..p..F...>..P.......pC....m.`5...R`...R...z6.rIiQ#...D.EI.PQ....N..%.Q....q..A....;P....en...6.....y.b.|.)O.Q........n.....w..$.p...+V.O...o......4....K...R..).......ko...u...O.;U5J\.V6g .9..Q.........b.m@..p.*1...t.fr...dg*._.8uhc.i;!.3. ..N.r..Y9a....2iC.y.x.J..q..H't.W.ha...Ep. l.B,oB..o..{.%.T....d%..m.3...&.YnUf...U..f...QB.4..Ty)tU..XO.Z]!........._7

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\SplashScreen.bmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):120390
                                                                        Entropy (8bit):7.998471732578129
                                                                        Encrypted:true
                                                                        SSDEEP:3072:BYgbIHy6fymE8fhsTjZ/tvbFLn4z/wv+++Ajne19K/sZ:Fbuy6amE8p2j1biV++Ajnea/o
                                                                        MD5:9EAAC88D4246AF79FE9A4E4A1C304632
                                                                        SHA1:D1926C2A9CF7855268B658B40CA9929D1E8A24EA
                                                                        SHA-256:F935C4CED3C88541D77D0F6E7C57CFB4E4B7D1F8063BD826F23F1848E39E7F73
                                                                        SHA-512:5DAC9D9B4877678F5ADCC53C414E286FD64D5BEF2FC7611991DFA3231D1F85B65422C418AC37C77DF13D2AF09441F95CFEBF1F8B94C58DAFD5D4B67B95E3217A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:BM....1u>A.18...>.[..:......Q)....../...Tk.|6..*.......{..V.]b....l,.d.G;4__.....x.&.....V..]^..F.6&.>..\.y...cT#D...n....W....I.x1.....w..?. .BM....{Hv .3...."..`..*......e....E.l..H.UD|.. ...z.pN.^.....9........v..H.......5....#..h=..n....~...bi.o..?.....l...5.@.o..~.t..FM.)R.p(.....-.Ka.../...9A0.4.q..F.&.....l...x...%...0.<+4MQ../+-. sBJ{cawn......j....\..d..Jd.n.A.|.*..Z.P........".s...G....*...x.N...{.G...nK._..^.H.f|../.z...A......2.M......Hm`.......}...&...3.gu.c...q.RLaj..........y]$3....C..'.wV..S.:.%.)...S.....-.\...J..l`K.X..$vv0.cj..N....JB..P.f{.`..GH.=.k..y...p}.M...B...M.......'.h..`,^.~).y.9%.....D.....6...@........27.Q...$6..q.....|Ut......Z..D4...N.a. b.UM..2...N.sw..S..pN...#^.0..`..o..E....0E.)\I.a=......+/...`..g....X.b..+5...[.8.Jc.fJ..4?.y.5I.KXn......b.....`..!.....U.l`....`.9.......J..l...l.i.C~|ZD...=z.?}WO......I#..2.8..:.,k.....5b..-<7...ik...c........6..Of.7 @h~....A...J..T..bE..d.YP.#.^d.....x<...*........J.a/.}..p..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\SplashScreen.bmp.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):120390
                                                                        Entropy (8bit):7.998471732578129
                                                                        Encrypted:true
                                                                        SSDEEP:3072:BYgbIHy6fymE8fhsTjZ/tvbFLn4z/wv+++Ajne19K/sZ:Fbuy6amE8p2j1biV++Ajnea/o
                                                                        MD5:9EAAC88D4246AF79FE9A4E4A1C304632
                                                                        SHA1:D1926C2A9CF7855268B658B40CA9929D1E8A24EA
                                                                        SHA-256:F935C4CED3C88541D77D0F6E7C57CFB4E4B7D1F8063BD826F23F1848E39E7F73
                                                                        SHA-512:5DAC9D9B4877678F5ADCC53C414E286FD64D5BEF2FC7611991DFA3231D1F85B65422C418AC37C77DF13D2AF09441F95CFEBF1F8B94C58DAFD5D4B67B95E3217A
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:BM....1u>A.18...>.[..:......Q)....../...Tk.|6..*.......{..V.]b....l,.d.G;4__.....x.&.....V..]^..F.6&.>..\.y...cT#D...n....W....I.x1.....w..?. .BM....{Hv .3...."..`..*......e....E.l..H.UD|.. ...z.pN.^.....9........v..H.......5....#..h=..n....~...bi.o..?.....l...5.@.o..~.t..FM.)R.p(.....-.Ka.../...9A0.4.q..F.&.....l...x...%...0.<+4MQ../+-. sBJ{cawn......j....\..d..Jd.n.A.|.*..Z.P........".s...G....*...x.N...{.G...nK._..^.H.f|../.z...A......2.M......Hm`.......}...&...3.gu.c...q.RLaj..........y]$3....C..'.wV..S.:.%.)...S.....-.\...J..l`K.X..$vv0.cj..N....JB..P.f{.`..GH.=.k..y...p}.M...B...M.......'.h..`,^.~).y.9%.....D.....6...@........27.Q...$6..q.....|Ut......Z..D4...N.a. b.UM..2...N.sw..S..pN...#^.0..`..o..E....0E.)\I.a=......+/...`..g....X.b..+5...[.8.Jc.fJ..4?.y.5I.KXn......b.....`..!.....U.l`....`.9.......J..l...l.i.C~|ZD...=z.?}WO......I#..2.8..:.,k.....5b..-<7...ik...c........6..Of.7 @h~....A...J..T..bE..d.YP.#.^d.....x<...*........J.a/.}..p..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Strings.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):14418
                                                                        Entropy (8bit):7.986959077388949
                                                                        Encrypted:false
                                                                        SSDEEP:384:j3aqWx13EbseeSuwCeCg5OFxLxd0Nqy7PQSaT:j37w13msfSuc5OTLf0Nt7yT
                                                                        MD5:CF9A62943D43518E7861ABEE5A5A1AAF
                                                                        SHA1:05D1904648D637F9CA3FF41C9CFB1494397CC033
                                                                        SHA-256:2BE172E1644A0C69FA0C5FEE5A086533FFA2F8EF66676FE8160C647339EB3D98
                                                                        SHA-512:1CC66771D8980986CB105E6C049300426A7DFDD2DC0DD7BB86B9C15A07971FB1F45D7B56D50872DB570D2144217C6069C4DD6399CA91B61FEEE7DE889F87AC1B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:..<.?mE....s|S.:...{..y.-.+.....}..;.......ba/.....C.W.z..dN<[}J...P.......=g.]3..<V....u..5..15B..3.m.......G...>...w~..@..[s..A...H...$......$9,.......Umt(...$.....+"..0...G..4C..c....fz~W".k.....g.ve..T.../...}.%.J....c{M..r....?.8.e........V.1A..]..Q...c...D.......y.E?....J..~.........j...V4..T.d.?.zf..b8..X..'.S..~.D..... ....YKM..m..,'Zh...p1..........g....XV....%..0x...K.P.0.Hn ..\.#3".z....._...+..<8......1..]i]...d...kd..6q.KPA:.......Z....g..........C....]..h.......m.....;..:g.6........:.j..... .`,..#.VO..].....t'.(.o....o...m.23.ar.....h.-...Vo)@u..X.Bo........Q...l..W.N&,A.yo1.....r.U.5?2@R......7...r[*...c.)I..B.._!....*../....9.]y..G.=..1..!S.2q....i^...V..5.@Q [.>O...gG!.N|.n.'D.w<:..w...,jx.k ...t].bK..K9.M....MM.9...........:.mZ#i...G.....$.Vz.V.A..=.._J.nhF.."93.........#...a../A..?...$.Y.e..i.@.....5.....C...L4B~.Q...?Q.B.h.gH?.k@X/mF..s;.}.....@..k..}(z.a..x...#)x....!.kl..?..5.v.i........Y.Q..N.mv*..|^Pa...5...JM..isX?...l.J

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\Strings.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):14418
                                                                        Entropy (8bit):7.986959077388949
                                                                        Encrypted:false
                                                                        SSDEEP:384:j3aqWx13EbseeSuwCeCg5OFxLxd0Nqy7PQSaT:j37w13msfSuc5OTLf0Nt7yT
                                                                        MD5:CF9A62943D43518E7861ABEE5A5A1AAF
                                                                        SHA1:05D1904648D637F9CA3FF41C9CFB1494397CC033
                                                                        SHA-256:2BE172E1644A0C69FA0C5FEE5A086533FFA2F8EF66676FE8160C647339EB3D98
                                                                        SHA-512:1CC66771D8980986CB105E6C049300426A7DFDD2DC0DD7BB86B9C15A07971FB1F45D7B56D50872DB570D2144217C6069C4DD6399CA91B61FEEE7DE889F87AC1B
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:..<.?mE....s|S.:...{..y.-.+.....}..;.......ba/.....C.W.z..dN<[}J...P.......=g.]3..<V....u..5..15B..3.m.......G...>...w~..@..[s..A...H...$......$9,.......Umt(...$.....+"..0...G..4C..c....fz~W".k.....g.ve..T.../...}.%.J....c{M..r....?.8.e........V.1A..]..Q...c...D.......y.E?....J..~.........j...V4..T.d.?.zf..b8..X..'.S..~.D..... ....YKM..m..,'Zh...p1..........g....XV....%..0x...K.P.0.Hn ..\.#3".z....._...+..<8......1..]i]...d...kd..6q.KPA:.......Z....g..........C....]..h.......m.....;..:g.6........:.j..... .`,..#.VO..].....t'.(.o....o...m.23.ar.....h.-...Vo)@u..X.Bo........Q...l..W.N&,A.yo1.....r.U.5?2@R......7...r[*...c.)I..B.._!....*../....9.]y..G.=..1..!S.2q....i^...V..5.@Q [.>O...gG!.N|.n.'D.w<:..w...,jx.k ...t].bK..K9.M....MM.9...........:.mZ#i...G.....$.Vz.V.A..=.._J.nhF.."93.........#...a../A..?...$.Y.e..i.@.....5.....C...L4B~.Q...?Q.B.h.gH?.k@X/mF..s;.}.....@..k..}(z.a..x...#)x....!.kl..?..5.v.i........Y.Q..N.mv*..|^Pa...5...JM..isX?...l.J

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\UiInfo.xml

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):65738
                                                                        Entropy (8bit):7.996735717009111
                                                                        Encrypted:true
                                                                        SSDEEP:1536:KRaRw9DeQzVkxtZ7fpM7GreAlkWLJd4ezZuTyY8EKqi4rojSkFqz:GNeRRMyfJTNLEKP1mz
                                                                        MD5:5F0C19637CFB401AB45C4877A7AE10A1
                                                                        SHA1:8735941675DFB3C59265FE41D5BDB5B977F4957D
                                                                        SHA-256:1DCA078B73E8058BB8E423D561FCD6D750EE9B403410A4907DBAE6114D7EC0F5
                                                                        SHA-512:36F5B2151812D2E6378FE8896DC644F3A05AF2E4813CD43AFBE3883FF4DA7340D1EBCD0D6DF92CA5EA7C797F6EB9BF93C141E4ADA65A109CC82EB904F0E117C7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..P....=/.{Y....O..y....)..*..}.$.KU2..=...../..).O...L....c..V/J...l...v.T~...7..~..%..vp:8..._Z....vO..Js...].#....p..7^...)..5..d..6.3..1\....=.....r.X..V..y...R.b!^...xW...5..W..%....R...G.yp......V.&......y.3y..BD..(.d.$Q..r.8....#.V.4.....^>y.r..}5..&...m.8....~....s....'...r.D..s[S...T!c.#h.8.$.o.......[.8.M...SKKF.r.a.............&.....{z.Mj.]..u..3....E.....E...B..`.......R.z...m@u...k...#.!......O..s..f.QG...%Y.!K.^.q.....I.Y.-..UC..z._Z..M.^...U.....|....a.5*.\.0F._;..%t.WU.u.>9....:......,.=.7....s.?.-8.f.s.R.\.ED......K3...E.v.>!(AT.........r.0...!....m.V;...,w.l+....T&.0....n...[O.MN.t0O.W{.C..8s.{ C.Xn.3i........x7e....l...o...+4.#..J8.k...4.J..[1.........&..s.&..B....q.C..T.!..q.6Nq....W....9..k...h..aa..h..@......m.T&O.T...e.k.y.R.L."?qj...BQ(.....V6.V.+!...E.*.....$i...t.|...9'Z!..,.k.!#.I...{\h..<P.K..?C.k......7.^.....y%?.iX..szm..C.eG>.[F......1G..#..O...XT?.(Qb..J..&.}.?........... ..X.`,B#..z..)......x..=.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\UiInfo.xml.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):65738
                                                                        Entropy (8bit):7.996735717009111
                                                                        Encrypted:true
                                                                        SSDEEP:1536:KRaRw9DeQzVkxtZ7fpM7GreAlkWLJd4ezZuTyY8EKqi4rojSkFqz:GNeRRMyfJTNLEKP1mz
                                                                        MD5:5F0C19637CFB401AB45C4877A7AE10A1
                                                                        SHA1:8735941675DFB3C59265FE41D5BDB5B977F4957D
                                                                        SHA-256:1DCA078B73E8058BB8E423D561FCD6D750EE9B403410A4907DBAE6114D7EC0F5
                                                                        SHA-512:36F5B2151812D2E6378FE8896DC644F3A05AF2E4813CD43AFBE3883FF4DA7340D1EBCD0D6DF92CA5EA7C797F6EB9BF93C141E4ADA65A109CC82EB904F0E117C7
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:..<.?..P....=/.{Y....O..y....)..*..}.$.KU2..=...../..).O...L....c..V/J...l...v.T~...7..~..%..vp:8..._Z....vO..Js...].#....p..7^...)..5..d..6.3..1\....=.....r.X..V..y...R.b!^...xW...5..W..%....R...G.yp......V.&......y.3y..BD..(.d.$Q..r.8....#.V.4.....^>y.r..}5..&...m.8....~....s....'...r.D..s[S...T!c.#h.8.$.o.......[.8.M...SKKF.r.a.............&.....{z.Mj.]..u..3....E.....E...B..`.......R.z...m@u...k...#.!......O..s..f.QG...%Y.!K.^.q.....I.Y.-..UC..z._Z..M.^...U.....|....a.5*.\.0F._;..%t.WU.u.>9....:......,.=.7....s.?.-8.f.s.R.\.ED......K3...E.v.>!(AT.........r.0...!....m.V;...,w.l+....T&.0....n...[O.MN.t0O.W{.C..8s.{ C.Xn.3i........x7e....l...o...+4.#..J8.k...4.J..[1.........&..s.&..B....q.C..T.!..q.6Nq....W....9..k...h..aa..h..@......m.T&O.T...e.k.y.R.L."?qj...BQ(.....V6.V.+!...E.*.....$i...t.|...9'Z!..,.k.!#.I...{\h..<P.K..?C.k......7.^.....y%?.iX..szm..C.eG>.[F......1G..#..O...XT?.(Qb..J..&.}.?........... ..X.`,B#..z..)......x..=.

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\_readme.txt

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):1109
                                                                        Entropy (8bit):4.850911315566649
                                                                        Encrypted:false
                                                                        SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYLuWQM7mFRqrl3W4kA+GT/kF5M2/kLw3KTJR:WZHfv0p6WQM7PFWrDGT0f/krX
                                                                        MD5:24EC1F63BD267C178E9C0808AE6E2F40
                                                                        SHA1:5FF627645182DAAF46051185037A3E8A46E7DE5B
                                                                        SHA-256:57E08E1402CC0EE684941437410864C25FD4FDE7A0CE6CEF685AC82A229A1573
                                                                        SHA-512:3C4B8DDF17035C6BAA1ACA17177AD39DD6542F1468088623BC92B56D71E69D7A910A9BE00B5884339348FFCAFF72418CFD8AB3A897772AD10F9758A63608442C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-e5pgPH03fe..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\header.bmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):9994
                                                                        Entropy (8bit):7.981964191010265
                                                                        Encrypted:false
                                                                        SSDEEP:192:8QbawgXDfxyOdtFo7ldc/ycDCjWGxwhuEL2B+IdpQv/xZCLdSTCG:8zwgXDfxglqymCjD+eIvRZCxQCG
                                                                        MD5:BD5FE176EA7F5EC76B7C565373EC1624
                                                                        SHA1:08FD7A083548AB5E608068B70E67E2384099FEA8
                                                                        SHA-256:1EBFF701D0E7CCF530AA875C6AA62F4D380BAC78062F1C1A30349D00C3782551
                                                                        SHA-512:613FF62CE33310796F701BF598FBE52C97833615AD5962B9660C44E2610B5E8839EE8BB2355564886991817312D74004A00B44D9A31E80A9518A1F94B89DA1B2
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:BM.%....6.Q......u..#.min..-.J...x.6...D9.....D..w...E.g..N.V.[...7H..~s[..b.H.W..p..}L..[......A.t.a...L...@U.....WdS.......lf3Q.`......B....W$f......$G.....@.|.7.:w0.s*..q .c.....D...c.l~;^FH#.?ph......a>H...>k`.j..r..!$.-...........^..\.O\.....gL](...`..<..?..,B/.f.e(n..Dl..@.....N[`c...d...X.r......c..I.R..T.m..zS@....;R(/.5...D!...Hn....KB...v(..d.VUZ4/..$.8...:.O./k....;...^.n.H.....-..^X..v...?.*.}...U.........18......;...#d:....o.w..e=.}3.....r.......[%.:.aS'.I...Z..].."[jcQ;R.C7...Y...b.0..%K.Rv.:`q'.ZY.4.L>.............../"..zOz.}..7K%.Q.>..k..#=....-!...lB....N.S........9..m.6..La.t0.x2h/....h.t.9..6E..v.A..*..p..f..i4a.....D.].gOA...P.....&{...o....S.D....dL.E.......b..{.+F.H..Hy.u....u.S.....?Pk:.......I.r[.h.d...UP...WN..........a!........q0...l7n.=i...NP...Qy.........6!'..rh.......:..P;p..@.....[.JtG......n....z...Q1nT...vp0..../.HF."....#..$..9.t.<Wb"S.+2.}..<..........V.a..$V...5...M..4A...M9..B.AZ..|...v3..(..#Z.?.o3t.!..H...^

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\header.bmp.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):9994
                                                                        Entropy (8bit):7.981964191010265
                                                                        Encrypted:false
                                                                        SSDEEP:192:8QbawgXDfxyOdtFo7ldc/ycDCjWGxwhuEL2B+IdpQv/xZCLdSTCG:8zwgXDfxglqymCjD+eIvRZCxQCG
                                                                        MD5:BD5FE176EA7F5EC76B7C565373EC1624
                                                                        SHA1:08FD7A083548AB5E608068B70E67E2384099FEA8
                                                                        SHA-256:1EBFF701D0E7CCF530AA875C6AA62F4D380BAC78062F1C1A30349D00C3782551
                                                                        SHA-512:613FF62CE33310796F701BF598FBE52C97833615AD5962B9660C44E2610B5E8839EE8BB2355564886991817312D74004A00B44D9A31E80A9518A1F94B89DA1B2
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:BM.%....6.Q......u..#.min..-.J...x.6...D9.....D..w...E.g..N.V.[...7H..~s[..b.H.W..p..}L..[......A.t.a...L...@U.....WdS.......lf3Q.`......B....W$f......$G.....@.|.7.:w0.s*..q .c.....D...c.l~;^FH#.?ph......a>H...>k`.j..r..!$.-...........^..\.O\.....gL](...`..<..?..,B/.f.e(n..Dl..@.....N[`c...d...X.r......c..I.R..T.m..zS@....;R(/.5...D!...Hn....KB...v(..d.VUZ4/..$.8...:.O./k....;...^.n.H.....-..^X..v...?.*.}...U.........18......;...#d:....o.w..e=.}3.....r.......[%.:.aS'.I...Z..].."[jcQ;R.C7...Y...b.0..%K.Rv.:`q'.ZY.4.L>.............../"..zOz.}..7K%.Q.>..k..#=....-!...lB....N.S........9..m.6..La.t0.x2h/....h.t.9..6E..v.A..*..p..f..i4a.....D.].gOA...P.....&{...o....S.D....dL.E.......b..{.+F.H..Hy.u....u.S.....?Pk:.......I.r[.h.d...UP...WN..........a!........q0...l7n.=i...NP...Qy.........6!'..rh.......:..P;p..@.....[.JtG......n....z...Q1nT...vp0..../.HF."....#..$..9.t.<Wb"S.+2.}..<..........V.a..$V...5...M..4A...M9..B.AZ..|...v3..(..#Z.?.o3t.!..H...^

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\watermark.bmp

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):104406
                                                                        Entropy (8bit):7.99811635994121
                                                                        Encrypted:true
                                                                        SSDEEP:1536:QT3tmUf7Yc961676vBHYdyYFtGgNp0S9SQWmAbv+EpVFu1cEYFGXirQw58q9vcq:Ksg7PvUB4dy8tG7S9SZbN3mYAW5cq
                                                                        MD5:34D32301F7E1C9D15D0707549343A486
                                                                        SHA1:E23687A99BD480E2652124E760FAD17975C75292
                                                                        SHA-256:24CD5582D8D5B8B0C26D89841D60FF30C5B67B1B0066E741F819EF244FF3C25F
                                                                        SHA-512:595E0B4719CB6C1D0F0D361E0BB664473847AABEECEC4F14A2BF4FD659099A04ADA288DF88AEBE2B54362E635440343E03D72927E8BBDF0604D318DB90470F8C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:BM.....+.S..r...'~o..z....ZG..L...........xseW.2...*.....?......i.U_..$......lv.!.*Z8..............]`.[..G.#...4w...R....._.)...T.....~...!T.E.A6k.......h^5.$F.7\..6........#.#re.........]...^.W_..v..X...UO..".f......bn^.....\...udad....S.gtF...D......[..H.?...j.....R..N`=@j....>.j..P.*.}.T.).T...q..SL.......t.H.........v.....E..._..%.&2.w.[;.YE.w...l.&.....~~[7..E.|..+.fY.K......N."_.I.I..6Y........`Sn.Of....9)C+-...mj...c...........Q 2...b.%.7.u...D...`-t?.MEt.Y..sZ.zhh....q...3..'.1CH..(+z..n...g..j+.2]|..Cj..a-..)....cB.p.@..\.5J.NKu..bXY^..lY.....jc.....#.G.J~0.....qk...!... .X.o....4..]..._... "..._..../2...=.!...}IY.+.]:..1..}..1.+.X......'...U...=R.n.a9..D[.C../sF..|.....R.....(q.._........Y...c.Ed......V.y9#.p..<!KBo...7.....{......s..B......y.T..^..Rat.s.\..6s.p.(-.uT.......>t.c..g..u....%.A.2j..1..l.Z...0.T.p...[......oN.{...Jw.1,..A...7..B..."@o....a.O.U.2.ED.....E.E.!........$.$..9,..U7dg.cO........A.}.5!.......~.8..w..v.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\watermark.bmp.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):104406
                                                                        Entropy (8bit):7.99811635994121
                                                                        Encrypted:true
                                                                        SSDEEP:1536:QT3tmUf7Yc961676vBHYdyYFtGgNp0S9SQWmAbv+EpVFu1cEYFGXirQw58q9vcq:Ksg7PvUB4dy8tG7S9SZbN3mYAW5cq
                                                                        MD5:34D32301F7E1C9D15D0707549343A486
                                                                        SHA1:E23687A99BD480E2652124E760FAD17975C75292
                                                                        SHA-256:24CD5582D8D5B8B0C26D89841D60FF30C5B67B1B0066E741F819EF244FF3C25F
                                                                        SHA-512:595E0B4719CB6C1D0F0D361E0BB664473847AABEECEC4F14A2BF4FD659099A04ADA288DF88AEBE2B54362E635440343E03D72927E8BBDF0604D318DB90470F8C
                                                                        Malicious:true
                                                                        Reputation:low
                                                                        Preview:BM.....+.S..r...'~o..z....ZG..L...........xseW.2...*.....?......i.U_..$......lv.!.*Z8..............]`.[..G.#...4w...R....._.)...T.....~...!T.E.A6k.......h^5.$F.7\..6........#.#re.........]...^.W_..v..X...UO..".f......bn^.....\...udad....S.gtF...D......[..H.?...j.....R..N`=@j....>.j..P.*.}.T.).T...q..SL.......t.H.........v.....E..._..%.&2.w.[;.YE.w...l.&.....~~[7..E.|..+.fY.K......N."_.I.I..6Y........`Sn.Of....9)C+-...mj...c...........Q 2...b.%.7.u...D...`-t?.MEt.Y..sZ.zhh....q...3..'.1CH..(+z..n...g..j+.2]|..Cj..a-..)....cB.p.@..\.5J.NKu..bXY^..lY.....jc.....#.G.J~0.....qk...!... .X.o....4..]..._... "..._..../2...=.!...}IY.+.]:..1..}..1.+.X......'...U...=R.n.a9..D[.C../sF..|.....R.....(q.._........Y...c.Ed......V.y9#.p..<!KBo...7.....{......s..B......y.T..^..Rat.s.\..6s.p.(-.uT.......>t.c..g..u....%.A.2j..1..l.Z...0.T.p...[......oN.{...Jw.1,..A...7..B..."@o....a.O.U.2.ED.....E.E.!........$.$..9,..U7dg.cO........A.}.5!.......~.8..w..v.....

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\x64-Windows10.0-KB4486153-x64.cab

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):345934949
                                                                        Entropy (8bit):6.358699017465636
                                                                        Encrypted:false
                                                                        SSDEEP:3145728:3thi3WjD0R2MypgktF60iPf349x1A10QWbPxD+vC5W2uEQEb9XEag:3vSWs4Mypgy4Pfy1D+vCwEQEp6
                                                                        MD5:FC994D4934D59AA6E66A9D0B41ECF4BD
                                                                        SHA1:220F591C475814920162AB9326555DF6AAF4ABC7
                                                                        SHA-256:9722AC949454C737AF856C6D76E90715EFB48AF48660C1892639FA70883D6B5B
                                                                        SHA-512:C2ADEB4BC7EEE59ACA498D24B7C1CAC9D34F6C2318E41D340726F1A16543D3AFA487F979101E04AB691B3D05E70152A1F6AF09C0DB3E7BD1F9F07DC00A56F945
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MSCF..^$.......3..X.....<MYd*..#....U.|].UZ....CP....@.kS....E...>....[.v.@.PE.{m.C....1..}w^....>...'.l..C.x`....Y.%.Q..[..Fj...~y>...].=5G..1....:.e.rB../[zq.H.h......Mi=g57.$...%.](p.W5.#t.......rX..4.....O.%`H...."X....;.p......LGhc.J..,4iH.....@.<._u=.....D.b..J*V..0.z......|.;.4i(.#.m...}...a...E.xR...~,-<\X7......`O..u.6...X. )J..n.$07.....hS..zWf..XyB..gM.9&.`'-.._>D..Kz..*$E.$!f:..M..............`.......P.&.Et$J..~xn...IH)..F....+.r..n@..|..z.C..eIm.....|7.l..K..9/.k..x..\.T..m..oz.......Wtpq..&.u..u........d...F-...s**........{4L.-}..b....<..Ic\.f/.........B...u'O...z.=.iLMY...U....z6r.?(B(9G.~.F...k.~.d......90.>..H3.....X.y..@Bk;G....$...Q.-ez...p.}Xdqa.N...X7..y.S...|\5@.H..e..>..V.~...............%..._.`$.....O.-......k$...e....+..x.*..#uvY.8T.j..QK.)..~)>..,8.iMWn..+.d..}..JT)..%J.-..8i.....z.^.C6(..-...........41.+?..M.q.y...v..T#.+...5N...0.......4...h..w.7.P.GG.?...;.Wuh....n..)`......TsUc....[$....g......R..C.h. ..

                                                                        C:\adc91a0e0132170ee1c9ace67d4b\x64-Windows10.0-KB4486153-x64.cab.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):345934949
                                                                        Entropy (8bit):6.358699017465636
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:FC994D4934D59AA6E66A9D0B41ECF4BD
                                                                        SHA1:220F591C475814920162AB9326555DF6AAF4ABC7
                                                                        SHA-256:9722AC949454C737AF856C6D76E90715EFB48AF48660C1892639FA70883D6B5B
                                                                        SHA-512:C2ADEB4BC7EEE59ACA498D24B7C1CAC9D34F6C2318E41D340726F1A16543D3AFA487F979101E04AB691B3D05E70152A1F6AF09C0DB3E7BD1F9F07DC00A56F945
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:MSCF..^$.......3..X.....<MYd*..#....U.|].UZ....CP....@.kS....E...>....[.v.@.PE.{m.C....1..}w^....>...'.l..C.x`....Y.%.Q..[..Fj...~y>...].=5G..1....:.e.rB../[zq.H.h......Mi=g57.$...%.](p.W5.#t.......rX..4.....O.%`H...."X....;.p......LGhc.J..,4iH.....@.<._u=.....D.b..J*V..0.z......|.;.4i(.#.m...}...a...E.xR...~,-<\X7......`O..u.6...X. )J..n.$07.....hS..zWf..XyB..gM.9&.`'-.._>D..Kz..*$E.$!f:..M..............`.......P.&.Et$J..~xn...IH)..F....+.r..n@..|..z.C..eIm.....|7.l..K..9/.k..x..\.T..m..oz.......Wtpq..&.u..u........d...F-...s**........{4L.-}..b....<..Ic\.f/.........B...u'O...z.=.iLMY...U....z6r.?(B(9G.~.F...k.~.d......90.>..H3.....X.y..@Bk;G....$...Q.-ez...p.}Xdqa.N...X7..y.S...|\5@.H..e..>..V.~...............%..._.`$.....O.-......k$...e....+..x.*..#uvY.8T.j..QK.)..~)>..,8.iMWn..+.d..}..JT)..%J.-..8i.....z.^.C6(..-...........41.+?..M.q.y...v..T#.+...5N...0.......4...h..w.7.P.GG.?...;.Wuh....n..)`......TsUc....[$....g......R..C.h. ..

                                                                        C:\bootTel.dat

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):414
                                                                        Entropy (8bit):7.377784008827517
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1E2FB7617AB8B3E37BA718A96FC788E6
                                                                        SHA1:21106336A264E3DC41947928B1D4BDD41B8E0542
                                                                        SHA-256:905057DCF3CC6F42D9FE4403CCC76D39198F57B356A6EFAACEA22B620A894291
                                                                        SHA-512:9AD5B16E36EA8FE0F06F321D4759841E48BB2390525A09DB3422A3198D1A4F7B2A96CC34F69B9C4040A84EC7575706C173AD79EEA877DBA5276E9FAAC94006F9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:P............AP..o&.FZ.....c.E........:.....+...~.B...J1K...S.W%.\....&b.jo. ..KV>e..=t..`..7HG.y$!.Kx.4....8k.."azy...V....H...j..WSqM.$[d..W".<...Y.I*.w.![."!eZ.Cz.V|,......5...@....M-=..M.E'.W.....p.8_...S..#B.V..u[._..K..->..X..<Ux'..a.Iz@-8..R+zEe.5....*e.7P.T..<q0..'p.....a/....r..j.5.K..pzh...US.".u...D.x.../S,$";lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        C:\bootTel.dat.azhi (copy)

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):414
                                                                        Entropy (8bit):7.377784008827517
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:1E2FB7617AB8B3E37BA718A96FC788E6
                                                                        SHA1:21106336A264E3DC41947928B1D4BDD41B8E0542
                                                                        SHA-256:905057DCF3CC6F42D9FE4403CCC76D39198F57B356A6EFAACEA22B620A894291
                                                                        SHA-512:9AD5B16E36EA8FE0F06F321D4759841E48BB2390525A09DB3422A3198D1A4F7B2A96CC34F69B9C4040A84EC7575706C173AD79EEA877DBA5276E9FAAC94006F9
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:P............AP..o&.FZ.....c.E........:.....+...~.B...J1K...S.W%.\....&b.jo. ..KV>e..=t..`..7HG.y$!.Kx.4....8k.."azy...V....H...j..WSqM.$[d..W".<...Y.I*.w.![."!eZ.Cz.V|,......5...@....M-=..M.E'.W.....p.8_...S..#B.V..u[._..K..->..X..<Ux'..a.Iz@-8..R+zEe.5....*e.7P.T..<q0..'p.....a/....r..j.5.K..pzh...US.".u...D.x.../S,$";lfyRgbm7aZ5zpjJggzyGva9vFH6Xpmk3xwjgrUmT{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                        \Device\ConDrv

                                                                        Download File
                                                                        Process:C:\Users\user\AppData\Local\Temp\A388.exe
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):100
                                                                        Entropy (8bit):4.103465189601646
                                                                        Encrypted:false
                                                                        SSDEEP:
                                                                        MD5:F13DFDF2780A67DA085E0293137D2598
                                                                        SHA1:D7FF0833F47184D17368C8A80958898FDF795F16
                                                                        SHA-256:51F02976F51DEE08DFB66E124AE23CC193AD6EAC4811C0AB8C89B4DB621F2247
                                                                        SHA-512:B03F3031D5C4D89563204050C54F50636210D5DF8EABE1225B04E080E610D8B5D676FDC47DD47C462DE910246B9E6DC706706A7F426A45DE58A6C529F90ED340
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:Failed to Write Virtual Memory to new image base..Failed to Write Virtual Memory to new image base..

                                                                        Static File Info

                                                                        General

                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Entropy (8bit):5.420552889653068
                                                                        TrID:
                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                        File name:file.exe
                                                                        File size:313'344 bytes
                                                                        MD5:2ba491f6b487017a1c58b647a7e05d3c
                                                                        SHA1:b5b7f44bf018de87168323cceb09a0934ea661e0
                                                                        SHA256:e46720cac2a8956c652db483c7dd7b7fe0bcf7cdf8653d9687159e6355a17d7b
                                                                        SHA512:14d351ce46cfde55278c1cf43bb627f47bf469de84887dab547ee769d90ba59afc6cc617d647009cf90c3814f05f85ebf1104550454336078ad0aff46bdd1a83
                                                                        SSDEEP:3072:9TW8uN0G95ahxyZvs3wMkT8UcaQdJyzYQoWMSCfUC7wgsMet0lvS:VW800s5ahMmvgPcdeY/lR8C7w0x
                                                                        TLSH:A4646C5393E17C61E4268B729E2EC6F8775EF2608E5D37BA2258BA2B04701F2D173711
                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#u.*g..yg..yg..y.Z8yf..y.b>y}..y.b.y...y.b.yA..ynl3yn..yg..y...y.b.yf..y.b:yf..y.b=yf..yRichg..y........................PE..L..

                                                                        File Icon

                                                                        Icon Hash:455d8589544d2149

                                                                        Static PE Info

                                                                        General

                                                                        Entrypoint:0x4054ed
                                                                        Entrypoint Section:.text
                                                                        Digitally signed:false
                                                                        Imagebase:0x400000
                                                                        Subsystem:windows gui
                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                        DLL Characteristics:NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                        Time Stamp:0x630DC310 [Tue Aug 30 07:58:08 2022 UTC]
                                                                        TLS Callbacks:
                                                                        CLR (.Net) Version:
                                                                        OS Version Major:5
                                                                        OS Version Minor:1
                                                                        File Version Major:5
                                                                        File Version Minor:1
                                                                        Subsystem Version Major:5
                                                                        Subsystem Version Minor:1
                                                                        Import Hash:2d6b4f4a9e62e7d851c0b57974ea64af

                                                                        Entrypoint Preview

                                                                        Instruction
                                                                        call 00007FA31470E058h
                                                                        jmp 00007FA314709EAEh
                                                                        mov edi, edi
                                                                        push ebp
                                                                        mov ebp, esp
                                                                        sub esp, 20h
                                                                        mov eax, dword ptr [ebp+08h]
                                                                        push esi
                                                                        push edi
                                                                        push 00000008h
                                                                        pop ecx
                                                                        mov esi, 004012F0h
                                                                        lea edi, dword ptr [ebp-20h]
                                                                        rep movsd
                                                                        mov dword ptr [ebp-08h], eax
                                                                        mov eax, dword ptr [ebp+0Ch]
                                                                        pop edi
                                                                        mov dword ptr [ebp-04h], eax
                                                                        pop esi
                                                                        test eax, eax
                                                                        je 00007FA31470A02Eh
                                                                        test byte ptr [eax], 00000008h
                                                                        je 00007FA31470A029h
                                                                        mov dword ptr [ebp-0Ch], 01994000h
                                                                        lea eax, dword ptr [ebp-0Ch]
                                                                        push eax
                                                                        push dword ptr [ebp-10h]
                                                                        push dword ptr [ebp-1Ch]
                                                                        push dword ptr [ebp-20h]
                                                                        call dword ptr [00401130h]
                                                                        leave
                                                                        retn 0008h
                                                                        mov edi, edi
                                                                        push ebp
                                                                        mov ebp, esp
                                                                        mov eax, dword ptr [ebp+08h]
                                                                        mov dword ptr [0043FD34h], eax
                                                                        pop ebp
                                                                        ret
                                                                        mov edi, edi
                                                                        push ebp
                                                                        mov ebp, esp
                                                                        sub esp, 00000328h
                                                                        mov eax, dword ptr [0043C5B8h]
                                                                        xor eax, ebp
                                                                        mov dword ptr [ebp-04h], eax
                                                                        push ebx
                                                                        mov ebx, dword ptr [ebp+08h]
                                                                        push edi
                                                                        cmp ebx, FFFFFFFFh
                                                                        je 00007FA31470A029h
                                                                        push ebx
                                                                        call 00007FA31470E06Eh
                                                                        pop ecx
                                                                        and dword ptr [ebp-00000320h], 00000000h
                                                                        push 0000004Ch
                                                                        lea eax, dword ptr [ebp-0000031Ch]
                                                                        push 00000000h
                                                                        push eax
                                                                        call 00007FA31470E076h
                                                                        lea eax, dword ptr [ebp-00000320h]
                                                                        mov dword ptr [ebp-00000328h], eax
                                                                        lea eax, dword ptr [ebp-000002D0h]
                                                                        add esp, 0Ch
                                                                        mov dword ptr [ebp-00000324h], eax
                                                                        mov dword ptr [ebp-00000220h], eax
                                                                        mov dword ptr [ebp+00FFFDDCh], ecx

                                                                        Rich Headers

                                                                        Programming Language:
                                                                        • [ASM] VS2010 build 30319
                                                                        • [ C ] VS2010 build 30319
                                                                        • [C++] VS2010 build 30319
                                                                        • [IMP] VS2008 SP1 build 30729
                                                                        • [RES] VS2010 build 30319
                                                                        • [LNK] VS2010 build 30319

                                                                        Data Directories

                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x3adb40x64.text
                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x21910000xdbe8.rsrc
                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x42880x40.text
                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x10000x1fc.text
                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                        Sections

                                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                        .text0x10000x3a96e0x3aa00False0.515550039978678data5.644961988138778IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                        .data0x3c0000x2154c240x3e00unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                        .rsrc0x21910000xdbe80xdc00False0.36851917613636365data3.7542698511474337IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                        Resources

                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                        AFX_DIALOG_LAYOUT0x219e3000x2data5.0
                                                                        AFX_DIALOG_LAYOUT0x219e3080x2data5.0
                                                                        AFX_DIALOG_LAYOUT0x219e3100x2data5.0
                                                                        AFX_DIALOG_LAYOUT0x219e3180x2data5.0
                                                                        RT_ICON0x21915000x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.26514522821576764
                                                                        RT_ICON0x2193aa80x988Device independent bitmap graphic, 24 x 48 x 32, image size 00.3155737704918033
                                                                        RT_ICON0x21944580x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.6574909747292419
                                                                        RT_ICON0x2194d000x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.47894190871369297
                                                                        RT_ICON0x21972a80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.5058630393996247
                                                                        RT_ICON0x21983800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.27798507462686567
                                                                        RT_ICON0x21992280x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 00.39285714285714285
                                                                        RT_ICON0x21998f00x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.4046242774566474
                                                                        RT_ICON0x2199e580x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.22292531120331951
                                                                        RT_ICON0x219c4000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.2774390243902439
                                                                        RT_ICON0x219d4a80x988Device independent bitmap graphic, 24 x 48 x 32, image size 00.30040983606557375
                                                                        RT_ICON0x219de300x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.34397163120567376
                                                                        RT_STRING0x219e4e80x2a2Matlab v4 mat-file (little endian) D, numeric, rows 0, columns 00.48516320474777447
                                                                        RT_STRING0x219e7900x354data0.4671361502347418
                                                                        RT_STRING0x219eae80x100data0.5546875
                                                                        RT_GROUP_ICON0x21983500x30data0.9375
                                                                        RT_GROUP_ICON0x21944300x22data0.9705882352941176
                                                                        RT_GROUP_ICON0x219e2980x68data0.7307692307692307
                                                                        RT_VERSION0x219e3200x1c4ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 19700.5530973451327433

                                                                        Imports

                                                                        DLLImport
                                                                        KERNEL32.dllEnumCalendarInfoW, ReadConsoleA, GetCurrentProcess, SetDefaultCommConfigW, GetEnvironmentStringsW, GetModuleHandleExW, GetComputerNameW, SetCommBreak, CreateHardLinkA, GetSystemDefaultLCID, FreeEnvironmentStringsA, GetConsoleAliasesA, ReadConsoleW, GetConsoleAliasExesW, EnumTimeFormatsW, GetCommandLineA, TzSpecificLocalTimeToSystemTime, GlobalAlloc, LoadLibraryW, SetCommConfig, GetLocaleInfoW, InterlockedPopEntrySList, TransactNamedPipe, EnumSystemCodePagesA, HeapQueryInformation, GetCompressedFileSizeA, MultiByteToWideChar, GetStartupInfoW, DisconnectNamedPipe, DeleteVolumeMountPointA, GetNamedPipeHandleStateW, GetLastError, GetCurrentDirectoryW, ChangeTimerQueueTimer, SetLastError, GetTempFileNameA, LocalAlloc, GetFileType, MoveFileA, RemoveDirectoryW, FindAtomA, FindNextFileA, GetModuleHandleA, SetLocaleInfoW, FatalExit, RequestDeviceWakeup, CreateMailslotA, GetStringTypeW, VirtualProtect, QueryPerformanceFrequency, PeekConsoleInputA, SetCalendarInfoA, FindFirstVolumeA, FindAtomW, GetWindowsDirectoryW, AddConsoleAliasA, OpenFileMappingA, FindResourceW, GetCommandLineW, GetDriveTypeW, GetConsoleAliasesLengthW, WriteConsoleInputW, GetShortPathNameA, GetProcAddress, GetModuleHandleW, ExitProcess, DecodePointer, DeleteFileA, HeapReAlloc, HeapSetInformation, RaiseException, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, HeapAlloc, HeapFree, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, SetFilePointer, FreeEnvironmentStringsW, SetHandleCount, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, HeapSize, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringW, ReadFile, WriteConsoleW, CloseHandle, CreateFileW
                                                                        USER32.dllCharUpperA
                                                                        GDI32.dllSetBkColor, GetCharWidthA, GetKerningPairsA
                                                                        ADVAPI32.dllReadEventLogA

                                                                        Network Behavior

                                                                        ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        General

                                                                        Target ID:0
                                                                        Start time:14:03:55
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\System32\svchost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                        Imagebase:0x7ff7b1050000
                                                                        File size:51'288 bytes
                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:1
                                                                        Start time:14:03:56
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Desktop\file.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\Desktop\file.exe
                                                                        Imagebase:0x400000
                                                                        File size:313'344 bytes
                                                                        MD5 hash:2BA491F6B487017A1C58B647A7E05D3C
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000002.376788233.0000000004111000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.376743466.0000000002659000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000001.00000002.376714688.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.376709250.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:2
                                                                        Start time:14:04:01
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\explorer.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\Explorer.EXE
                                                                        Imagebase:0x7ff763730000
                                                                        File size:3'933'184 bytes
                                                                        MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:4
                                                                        Start time:14:04:17
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\System32\svchost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                        Imagebase:0x7ff7b1050000
                                                                        File size:51'288 bytes
                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:7
                                                                        Start time:14:04:21
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Roaming\jwjrtuw
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\AppData\Roaming\jwjrtuw
                                                                        Imagebase:0x400000
                                                                        File size:313'344 bytes
                                                                        MD5 hash:2BA491F6B487017A1C58B647A7E05D3C
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.428763684.00000000026F8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.428808631.00000000040F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                        • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.428745109.00000000026D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.428789330.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:10
                                                                        Start time:14:04:22
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        Imagebase:0x400000
                                                                        File size:836'608 bytes
                                                                        MD5 hash:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        Antivirus matches:
                                                                        • Detection: 56%, ReversingLabs
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:11
                                                                        Start time:14:04:22
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        Imagebase:0x400000
                                                                        File size:836'608 bytes
                                                                        MD5 hash:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:12
                                                                        Start time:14:04:23
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\System32\regsvr32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:regsvr32 /s C:\Users\user\AppData\Local\Temp\3958.dll
                                                                        Imagebase:0x7ff62df40000
                                                                        File size:24'064 bytes
                                                                        MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:13
                                                                        Start time:14:04:23
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\SysWOW64\regsvr32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline: /s C:\Users\user\AppData\Local\Temp\3958.dll
                                                                        Imagebase:0x130000
                                                                        File size:20'992 bytes
                                                                        MD5 hash:426E7499F6A7346F0410DEAD0805586B
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:14
                                                                        Start time:14:04:26
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\A388.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Users\user\AppData\Local\Temp\A388.exe
                                                                        Imagebase:0x7ff68a2f0000
                                                                        File size:244'736 bytes
                                                                        MD5 hash:3240F8928A130BB155571570C563200A
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Antivirus matches:
                                                                        • Detection: 70%, ReversingLabs
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:15
                                                                        Start time:14:04:26
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff766460000
                                                                        File size:625'664 bytes
                                                                        MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:16
                                                                        Start time:14:04:26
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        Imagebase:0x260000
                                                                        File size:42'056 bytes
                                                                        MD5 hash:EFBCDD2A3EBEA841996AEF00417AA958
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:17
                                                                        Start time:14:04:26
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        Imagebase:0x220000
                                                                        File size:42'056 bytes
                                                                        MD5 hash:EFBCDD2A3EBEA841996AEF00417AA958
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:18
                                                                        Start time:14:04:26
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                        Imagebase:0x9f0000
                                                                        File size:42'056 bytes
                                                                        MD5 hash:EFBCDD2A3EBEA841996AEF00417AA958
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:.Net C# or VB.NET
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:19
                                                                        Start time:14:04:29
                                                                        Start date:24/09/2023
                                                                        Path:C:\Windows\SysWOW64\icacls.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:icacls "C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                        Imagebase:0xd20000
                                                                        File size:29'696 bytes
                                                                        MD5 hash:FF0D1D4317A44C951240FAE75075D501
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:24
                                                                        Start time:14:04:30
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask
                                                                        Imagebase:0x400000
                                                                        File size:836'608 bytes
                                                                        MD5 hash:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.436925476.0000000004380000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000018.00000002.436833878.0000000004194000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:25
                                                                        Start time:14:04:30
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\4A15.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\4A15.exe" --Admin IsNotAutoStart IsNotTask
                                                                        Imagebase:0x400000
                                                                        File size:836'608 bytes
                                                                        MD5 hash:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000002.528674260.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:26
                                                                        Start time:14:04:31
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Users\user\Pictures\i4PHS5R0iEKcuu4uBuaRKA3v.exe"
                                                                        Imagebase:0x7ff77a410000
                                                                        File size:651'776 bytes
                                                                        MD5 hash:2D05CB7FB4726BB51C6059540F0E013E
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.621914047.00000000039FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.507939167.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.497133342.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.487597561.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.529764912.0000000003A33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.557010087.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.540745976.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.555251999.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.540098239.0000000003A02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.555268660.00000000039CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.529294566.0000000003A32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.624585849.0000000003A10000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.565892568.00000000039EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Fabookie, Description: Yara detected Fabookie, Source: 0000001A.00000003.587270076.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:27
                                                                        Start time:14:04:31
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task
                                                                        Imagebase:0x400000
                                                                        File size:836'608 bytes
                                                                        MD5 hash:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001B.00000002.521657270.00000000042E3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001B.00000002.521687562.0000000004390000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:28
                                                                        Start time:14:04:32
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                                                                        Imagebase:0x400000
                                                                        File size:5'550'656 bytes
                                                                        MD5 hash:3E74B7359F603F61B92CF7DF47073D4A
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:Borland Delphi
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:29
                                                                        Start time:14:04:32
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:C:\Users\user\AppData\Local\d11683cc-0d8b-41c4-a224-c03c55bb751f\4A15.exe --Task
                                                                        Imagebase:0x400000
                                                                        File size:836'608 bytes
                                                                        MD5 hash:0511A0C819ADE47392A2F3A51EAF1F0B
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001D.00000002.665875140.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:30
                                                                        Start time:14:04:32
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\4GAUQKCdkFpttJoyS2YGgxr9.exe"
                                                                        Imagebase:0xf00000
                                                                        File size:3'233'792 bytes
                                                                        MD5 hash:823B5FCDEF282C5318B670008B9E6922
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:.Net C# or VB.NET
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:31
                                                                        Start time:14:04:32
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                                                                        Imagebase:0x400000
                                                                        File size:312'832 bytes
                                                                        MD5 hash:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001F.00000002.446630399.0000000002858000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:32
                                                                        Start time:14:04:33
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                                                                        Imagebase:0x400000
                                                                        File size:763'826 bytes
                                                                        MD5 hash:A2CC32A235869FF08CE951A7C159D2A3
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:33
                                                                        Start time:14:04:33
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\U58dhzMU8ddvYuIUxUkOSiON.exe"
                                                                        Imagebase:0x400000
                                                                        File size:388'096 bytes
                                                                        MD5 hash:E4FA45F80EC75D24124D434010023355
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469268991.00000000056E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.468431350.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469512589.00000000057D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.470885243.0000000005859000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469454471.000000000564C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.483991106.00000000057FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.516044938.00000000057E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.472304844.0000000005778000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.470469816.000000000581B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.507376862.0000000005644000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.470206409.0000000005645000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.485627593.000000000564A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.482035496.000000000597E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496675989.00000000057BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496428031.00000000056DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.506833901.0000000005641000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.481731356.00000000057D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.510356408.0000000005642000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.471354546.000000000576B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.467924288.0000000005041000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.505042457.000000000574D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.474548520.000000000591A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.509183662.0000000005641000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.473692356.0000000005641000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.476789219.0000000005648000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.497850220.0000000005649000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.507439123.0000000005772000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.471831991.0000000005644000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496379528.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.507822905.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.473229721.00000000058DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.494997611.000000000506D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496490328.0000000005643000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.472464804.00000000058AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.467980289.000000000508B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.468510767.00000000056D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.494027534.0000000005041000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.506566555.0000000005858000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.509036426.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.500072033.0000000005724000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.470706005.000000000574C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.468398950.0000000005145000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.505246801.0000000005646000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.507273041.0000000005885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.482427984.000000000564C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.506178613.0000000005740000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.513208460.000000000564D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.493953689.00000000027BB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.481357469.0000000005640000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.467436264.00000000027BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.473342046.0000000005647000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.468889858.0000000005767000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.507966249.0000000005647000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.473782346.00000000057A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469115055.0000000005646000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469602619.0000000005712000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496104252.0000000005644000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469476494.000000000570E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496455854.0000000005781000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.522960258.0000000005BAF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.473123019.0000000005789000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.511094027.0000000005BAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496888012.00000000057FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496634961.00000000056F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_onlyLogger, Description: Yara detected onlyLogger, Source: 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: MALWARE_Win_OnlyLogger, Description: Detects OnlyLogger loader variants, Source: 00000021.00000003.444125965.0000000004260000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469550002.0000000005648000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.470580270.000000000564E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.509627314.00000000057AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496838267.000000000571E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.509729277.0000000005BA3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496201408.00000000056DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.509922852.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.470309156.0000000005728000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.472618978.0000000005642000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.509816939.000000000564A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.504449157.0000000005647000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.507153782.0000000005763000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.496753788.0000000005647000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.471595724.000000000588F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.468158250.00000000050DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.479409950.000000000595A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.471064264.000000000564D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.518524175.0000000005BAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.508451891.000000000579B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.473582112.00000000057A5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.510464244.00000000057C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469421690.000000000579A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.522225873.00000000057F4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.477931726.00000000057CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.469945364.00000000057E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.486685012.000000000580D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.485093495.00000000059BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.502766048.0000000005801000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.521207744.0000000005649000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:34
                                                                        Start time:14:04:33
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\941caPIfMmGnCq8PWe7WWHEk.exe"
                                                                        Imagebase:0x400000
                                                                        File size:4'402'048 bytes
                                                                        MD5 hash:64E22A1C0959444E0D23AE1977FB1075
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.542182071.00000000046F2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.550001229.0000000004AF0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000022.00000002.525875413.0000000000843000.00000040.00000001.01000000.00000017.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000022.00000002.550001229.0000000004F33000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:35
                                                                        Start time:14:04:34
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Users\user\Pictures\V1NdDWPeq5yoU55PUCrHuT1N.exe" /s
                                                                        Imagebase:0x400000
                                                                        File size:1'534'472 bytes
                                                                        MD5 hash:AA3602359BB93695DA27345D82A95C77
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:36
                                                                        Start time:14:04:34
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\f8hJzDp1zQtAPJgciyNSoGpb.exe"
                                                                        Imagebase:0x400000
                                                                        File size:4'402'064 bytes
                                                                        MD5 hash:659F20996F8E561EDEF3227A4407A3C8
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000024.00000002.541185132.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000024.00000002.541185132.0000000004F63000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000024.00000002.522431758.0000000000843000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000024.00000002.531504418.0000000004625000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:37
                                                                        Start time:14:04:34
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Pictures\t3PINyJoW83t7JJSZ5BPE6bi.exe"
                                                                        Imagebase:0x400000
                                                                        File size:312'832 bytes
                                                                        MD5 hash:45B35CD3B6D3BF79D6880813EBCF1717
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000025.00000002.457133950.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                        • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000025.00000002.457074870.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:38
                                                                        Start time:14:04:34
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-23R8R.tmp\Pwp3yspp3pM97CCYpnZxEaEs.tmp" /SL5="$1044C,4692544,832512,C:\Users\user\Pictures\Pwp3yspp3pM97CCYpnZxEaEs.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /PID=5333
                                                                        Imagebase:0x400000
                                                                        File size:3'209'984 bytes
                                                                        MD5 hash:5B1D2E9056C5F18324FA9DD4041B5463
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:Borland Delphi
                                                                        Antivirus matches:
                                                                        • Detection: 30%, ReversingLabs
                                                                        Reputation:low
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:39
                                                                        Start time:14:04:34
                                                                        Start date:24/09/2023
                                                                        Path:C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\is-O59IV.tmp\YRhJ9y7wcq2JenN54ladams2.tmp" /SL5="$30434,491750,408064,C:\Users\user\Pictures\YRhJ9y7wcq2JenN54ladams2.exe"
                                                                        Imagebase:0x400000
                                                                        File size:1'062'400 bytes
                                                                        MD5 hash:83827C13D95750C766E5BD293469A7F8
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Antivirus matches:
                                                                        • Detection: 6%, ReversingLabs
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        Disassembly

                                                                        Reset < >

                                                                          Execution Graph

                                                                          Execution Coverage:3.6%
                                                                          Dynamic/Decrypted Code Coverage:65.8%
                                                                          Signature Coverage:36.7%
                                                                          Total number of Nodes:79
                                                                          Total number of Limit Nodes:6
                                                                          execution_graph 7121 409000 7122 409005 _wcslen 7121->7122 7124 409017 7122->7124 7125 409a06 7122->7125 7127 409a0f 7125->7127 7128 409a4c 7127->7128 7129 40bf56 7127->7129 7128->7124 7131 40bf62 7129->7131 7130 40bf90 RtlAllocateHeap 7130->7131 7132 40bf6e 7130->7132 7131->7130 7131->7132 7132->7127 7172 4092e0 7173 4092f3 7172->7173 7174 409a06 __calloc_crt RtlAllocateHeap 7173->7174 7176 4092fe 7174->7176 7175 409a06 __calloc_crt RtlAllocateHeap 7175->7176 7176->7175 7177 409306 7176->7177 7194 402d40 7195 402d65 7194->7195 7196 402f37 7195->7196 7197 401932 8 API calls 7195->7197 7197->7196 7238 401523 7239 401529 7238->7239 7240 401608 NtDuplicateObject 7239->7240 7249 401724 7239->7249 7241 401625 NtCreateSection 7240->7241 7240->7249 7242 4016a5 NtCreateSection 7241->7242 7243 40164b NtMapViewOfSection 7241->7243 7244 4016d1 7242->7244 7242->7249 7243->7242 7245 40166e NtMapViewOfSection 7243->7245 7246 4016db NtMapViewOfSection 7244->7246 7244->7249 7245->7242 7247 40168c 7245->7247 7248 401702 NtMapViewOfSection 7246->7248 7246->7249 7247->7242 7248->7249 7198 401749 7199 4016cf 7198->7199 7200 4016db NtMapViewOfSection 7199->7200 7202 401724 7199->7202 7201 401702 NtMapViewOfSection 7200->7201 7200->7202 7201->7202 7133 4201b0 7134 4201d0 7133->7134 7137 41fb60 7134->7137 7136 420d63 7139 41fb86 __write_nolock 7137->7139 7138 41fd29 GlobalAlloc 7143 41fd47 _memset 7138->7143 7139->7138 7140 420043 VirtualProtect 7141 420069 7140->7141 7145 41fab0 LoadLibraryW 7141->7145 7143->7140 7144 4200ae _memset 7144->7136 7145->7144 7146 402e9b 7149 402ea1 7146->7149 7147 402f37 7149->7147 7150 401932 7149->7150 7151 401943 7150->7151 7152 401986 Sleep 7151->7152 7153 4019a1 7152->7153 7155 4019b2 7153->7155 7156 401558 7153->7156 7155->7147 7157 401567 7156->7157 7158 401608 NtDuplicateObject 7157->7158 7162 401724 7157->7162 7159 401625 NtCreateSection 7158->7159 7158->7162 7160 4016a5 NtCreateSection 7159->7160 7161 40164b NtMapViewOfSection 7159->7161 7160->7162 7163 4016d1 7160->7163 7161->7160 7164 40166e NtMapViewOfSection 7161->7164 7162->7155 7163->7162 7165 4016db NtMapViewOfSection 7163->7165 7164->7160 7166 40168c 7164->7166 7165->7162 7167 401702 NtMapViewOfSection 7165->7167 7166->7160 7167->7162 7233 402d7d 7234 402d83 7233->7234 7236 402deb 7233->7236 7235 401932 8 API calls 7237 402f37 7235->7237 7236->7235 7236->7237 7250 40193d 7251 40196a 7250->7251 7252 401986 Sleep 7251->7252 7253 4019a1 7252->7253 7254 401558 7 API calls 7253->7254 7255 4019b2 7253->7255 7254->7255

                                                                          Executed Functions

                                                                          Function 00401558 Relevance: 10.7, APIs: 7, Instructions: 206nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 0 401558-4015b2 call 4011f5 12 4015b4 0->12 13 4015b7-4015bc 0->13 12->13 15 4015c2-4015d3 13->15 16 4018d7-4018df 13->16 19 4018d5 15->19 20 4015d9-401602 15->20 16->13 21 4018e4-40192f call 4011f5 16->21 19->21 20->19 28 401608-40161f NtDuplicateObject 20->28 28->19 30 401625-401649 NtCreateSection 28->30 32 4016a5-4016cb NtCreateSection 30->32 33 40164b-40166c NtMapViewOfSection 30->33 32->19 35 4016d1-4016d5 32->35 33->32 36 40166e-40168a NtMapViewOfSection 33->36 35->19 38 4016db-4016fc NtMapViewOfSection 35->38 36->32 39 40168c-4016a2 36->39 38->19 42 401702-40171e NtMapViewOfSection 38->42 39->32 42->19 45 401724 42->45 45->19 46 401724 call 401729 45->46 46->19
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
                                                                          • Instruction ID: 4afb5ad6e9f78dbb0f0fc4dd380045413720c66cee1019041566b0107d6eeca4
                                                                          • Opcode Fuzzy Hash: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
                                                                          • Instruction Fuzzy Hash: 2F615E71900208FBEB209F91CC49FAF7BB8EF85B14F10412AF912BA1E5D6749901DB66
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 175nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 47 401564-4015b2 call 4011f5 57 4015b4 47->57 58 4015b7-4015bc 47->58 57->58 60 4015c2-4015d3 58->60 61 4018d7-4018df 58->61 64 4018d5 60->64 65 4015d9-401602 60->65 61->58 66 4018e4-40192f call 4011f5 61->66 64->66 65->64 73 401608-40161f NtDuplicateObject 65->73 73->64 75 401625-401649 NtCreateSection 73->75 77 4016a5-4016cb NtCreateSection 75->77 78 40164b-40166c NtMapViewOfSection 75->78 77->64 80 4016d1-4016d5 77->80 78->77 81 40166e-40168a NtMapViewOfSection 78->81 80->64 83 4016db-4016fc NtMapViewOfSection 80->83 81->77 84 40168c-4016a2 81->84 83->64 87 401702-40171e NtMapViewOfSection 83->87 84->77 87->64 90 401724 87->90 90->64 91 401724 call 401729 90->91 91->64
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
                                                                          • Instruction ID: 3c61d4fa49215657d74707620d36eaa57d50516e3f831c539a14d6838cb40392
                                                                          • Opcode Fuzzy Hash: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
                                                                          • Instruction Fuzzy Hash: 23513CB1900249FBEB209F91CC49FAF7BB8EF85710F14412AF911BA1E5D6749941CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 132 401577-4015b2 call 4011f5 139 4015b4 132->139 140 4015b7-4015bc 132->140 139->140 142 4015c2-4015d3 140->142 143 4018d7-4018df 140->143 146 4018d5 142->146 147 4015d9-401602 142->147 143->140 148 4018e4-40192f call 4011f5 143->148 146->148 147->146 155 401608-40161f NtDuplicateObject 147->155 155->146 157 401625-401649 NtCreateSection 155->157 159 4016a5-4016cb NtCreateSection 157->159 160 40164b-40166c NtMapViewOfSection 157->160 159->146 162 4016d1-4016d5 159->162 160->159 163 40166e-40168a NtMapViewOfSection 160->163 162->146 165 4016db-4016fc NtMapViewOfSection 162->165 163->159 166 40168c-4016a2 163->166 165->146 169 401702-40171e NtMapViewOfSection 165->169 166->159 169->146 172 401724 169->172 172->146 173 401724 call 401729 172->173 173->146
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
                                                                          • Instruction ID: ba3189e89dbc592d8eefb072767128172b6b3105eb2a85c49d1307986ab5c8dd
                                                                          • Opcode Fuzzy Hash: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
                                                                          • Instruction Fuzzy Hash: 9D511B71900249BFEB209F91CC48FAF7BB8FF85B14F10412AFA11BA1E5D6749941CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401523 Relevance: 10.7, APIs: 7, Instructions: 168nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 92 401523-401527 93 401529-40152e 92->93 94 40159f-4015b2 call 4011f5 92->94 93->94 97 4015b4 94->97 98 4015b7-4015bc 94->98 97->98 100 4015c2-4015d3 98->100 101 4018d7-4018df 98->101 104 4018d5 100->104 105 4015d9-401602 100->105 101->98 106 4018e4-40192f call 4011f5 101->106 104->106 105->104 113 401608-40161f NtDuplicateObject 105->113 113->104 115 401625-401649 NtCreateSection 113->115 117 4016a5-4016cb NtCreateSection 115->117 118 40164b-40166c NtMapViewOfSection 115->118 117->104 120 4016d1-4016d5 117->120 118->117 121 40166e-40168a NtMapViewOfSection 118->121 120->104 123 4016db-4016fc NtMapViewOfSection 120->123 121->117 124 40168c-4016a2 121->124 123->104 127 401702-40171e NtMapViewOfSection 123->127 124->117 127->104 130 401724 127->130 130->104 131 401724 call 401729 130->131 131->104
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$CreateDuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 3617974760-0
                                                                          • Opcode ID: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
                                                                          • Instruction ID: c9dca56e4daa214b2bd9150ebf0f157daf6c833c296841cdcd3f7df5e4c146b1
                                                                          • Opcode Fuzzy Hash: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
                                                                          • Instruction Fuzzy Hash: 91510A71900249BFEB209F92CC48F9FBBB8FF85B14F14411AFA11BA2A5D7749945CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040158C Relevance: 10.7, APIs: 7, Instructions: 168nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 174 40158c-4015b2 call 4011f5 178 4015b4 174->178 179 4015b7-4015bc 174->179 178->179 181 4015c2-4015d3 179->181 182 4018d7-4018df 179->182 185 4018d5 181->185 186 4015d9-401602 181->186 182->179 187 4018e4-40192f call 4011f5 182->187 185->187 186->185 194 401608-40161f NtDuplicateObject 186->194 194->185 196 401625-401649 NtCreateSection 194->196 198 4016a5-4016cb NtCreateSection 196->198 199 40164b-40166c NtMapViewOfSection 196->199 198->185 201 4016d1-4016d5 198->201 199->198 202 40166e-40168a NtMapViewOfSection 199->202 201->185 204 4016db-4016fc NtMapViewOfSection 201->204 202->198 205 40168c-4016a2 202->205 204->185 208 401702-40171e NtMapViewOfSection 204->208 205->198 208->185 211 401724 208->211 211->185 212 401724 call 401729 211->212 212->185
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
                                                                          • Instruction ID: 02d2e3ac3767ea31e924919402f7a0ff100aaf9667a8aefd77e34752db93229b
                                                                          • Opcode Fuzzy Hash: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
                                                                          • Instruction Fuzzy Hash: C9513AB1900249BFEB209F92CC48F9FBBB8FF85B14F10415AFA11AA1E5D7749944CB20
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401585 Relevance: 10.7, APIs: 7, Instructions: 165nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 213 401585-4015b2 call 4011f5 220 4015b4 213->220 221 4015b7-4015bc 213->221 220->221 223 4015c2-4015d3 221->223 224 4018d7-4018df 221->224 227 4018d5 223->227 228 4015d9-401602 223->228 224->221 229 4018e4-40192f call 4011f5 224->229 227->229 228->227 236 401608-40161f NtDuplicateObject 228->236 236->227 238 401625-401649 NtCreateSection 236->238 240 4016a5-4016cb NtCreateSection 238->240 241 40164b-40166c NtMapViewOfSection 238->241 240->227 243 4016d1-4016d5 240->243 241->240 244 40166e-40168a NtMapViewOfSection 241->244 243->227 246 4016db-4016fc NtMapViewOfSection 243->246 244->240 247 40168c-4016a2 244->247 246->227 250 401702-40171e NtMapViewOfSection 246->250 247->240 250->227 253 401724 250->253 253->227 254 401724 call 401729 253->254 254->227
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
                                                                          • Instruction ID: 9d9f292dd7e40d4d2d6115b75542e29ae97a3c703512c5fffb38717ec82669a3
                                                                          • Opcode Fuzzy Hash: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
                                                                          • Instruction Fuzzy Hash: 36511A75900249BFEB209F91CC48FAF7BB8FF85B14F10416AFA11BA1A5D6749941CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040159A Relevance: 10.7, APIs: 7, Instructions: 160nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 255 40159a-4015b2 call 4011f5 259 4015b4 255->259 260 4015b7-4015bc 255->260 259->260 262 4015c2-4015d3 260->262 263 4018d7-4018df 260->263 266 4018d5 262->266 267 4015d9-401602 262->267 263->260 268 4018e4-40192f call 4011f5 263->268 266->268 267->266 275 401608-40161f NtDuplicateObject 267->275 275->266 277 401625-401649 NtCreateSection 275->277 279 4016a5-4016cb NtCreateSection 277->279 280 40164b-40166c NtMapViewOfSection 277->280 279->266 282 4016d1-4016d5 279->282 280->279 283 40166e-40168a NtMapViewOfSection 280->283 282->266 285 4016db-4016fc NtMapViewOfSection 282->285 283->279 286 40168c-4016a2 283->286 285->266 289 401702-40171e NtMapViewOfSection 285->289 286->279 289->266 292 401724 289->292 292->266 293 401724 call 401729 292->293 293->266
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
                                                                          • Instruction ID: 1cd82c906aaffff485458f801d6ba595cb0416390f7e33d4f9d681d8d529f326
                                                                          • Opcode Fuzzy Hash: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
                                                                          • Instruction Fuzzy Hash: BF510971900249BFEB209F92CC48F9FBBB8FF85B14F104159FA11AA2A5D6749940CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401749 Relevance: 3.0, APIs: 2, Instructions: 40nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 498 401749-40174c 500 4018d5-40192f call 4011f5 498->500 501 4016db-4016fc NtMapViewOfSection 498->501 501->500 502 401702-40171e NtMapViewOfSection 501->502 502->500 504 401724 502->504 504->500 506 401724 call 401729 504->506 506->500
                                                                          APIs
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: SectionView
                                                                          • String ID:
                                                                          • API String ID: 1323581903-0
                                                                          • Opcode ID: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
                                                                          • Instruction ID: 088a864a315bec2a81033f27f4cad91d314b4a72151043dcf738e9c9ac7e5ebb
                                                                          • Opcode Fuzzy Hash: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
                                                                          • Instruction Fuzzy Hash: 0E011475500288FEEB219F92CC49FAF7FB9EF82B10F08016AF510B61E5E2714980CB20
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FB60 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 466memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 294 41fb60-41fb9a call 40d430 297 41fba0-41fba6 294->297 298 41fba8-41fbab 297->298 299 41fbae-41fbb4 297->299 298->299 300 41fbb6-41fbbe 299->300 301 41fbca-41fbd1 299->301 300->301 303 41fbc0-41fbc8 300->303 301->297 304 41fbd3-41fbdd 301->304 303->301 303->304 305 41fbe3-41fc41 304->305 306 41fcd9-41fced 304->306 347 41fc44-41fc49 305->347 307 41fcf0-41fcf6 306->307 308 41fd03-41fd0a 307->308 309 41fcf8-41fcfd 307->309 311 41fd20-41fd27 308->311 312 41fd0c-41fd1d 308->312 309->308 311->307 313 41fd29-41fd45 GlobalAlloc 311->313 312->311 316 41fd47-41fd4d 313->316 317 41fd8d-41fd90 313->317 320 41fd53-41fd58 316->320 318 41fe85-41fe9d 317->318 319 41fd96-41fe80 317->319 323 41fea5-41fea8 318->323 319->318 324 41fd60-41fd6d call 41f820 320->324 325 41fd5a-41fd5e 320->325 328 41fed8-41fedd 323->328 329 41feaa-41fed3 323->329 337 41fd88-41fd8b 324->337 338 41fd6f-41fd83 324->338 325->324 332 41fee3-41ffe4 call 4095e0 328->332 333 41ffe9-41ffed 328->333 329->328 332->333 333->323 336 41fff3-42000a 333->336 342 420010-420023 336->342 337->317 337->320 338->337 368 420025-42002b 342->368 347->347 351 41fc4b-41fc52 347->351 352 41fc54 351->352 353 41fc5e-41fc61 351->353 352->353 357 41fc71-41fc73 353->357 358 41fc63-41fc6f 353->358 361 41fc80-41fc8a 357->361 362 41fc75-41fc79 357->362 363 41fc7e 358->363 364 41fcbb-41fcbf 361->364 365 41fc8c-41fc94 361->365 362->363 363->361 371 41fcc1-41fccb 364->371 372 41fcce-41fcd3 364->372 369 41fc96 365->369 370 41fc9a-41fcb1 call 409660 365->370 374 420030-42003a 368->374 369->370 385 41fcb3 370->385 386 41fcb7 370->386 371->372 372->306 375 420040-420041 374->375 376 42003c 374->376 375->374 379 420043-420071 VirtualProtect call 41fb10 375->379 376->375 390 420076-42007c 379->390 385->386 386->364 393 42008e-420094 390->393 394 42007e-42008a 390->394 395 4200a0-4200a7 393->395 396 420096 393->396 394->393 395->390 399 4200a9 call 41fab0 395->399 396->395 403 4200ae-4200b8 399->403 405 4200be-420187 call 4095e0 403->405 406 42018f-4201a6 403->406 405->406
                                                                          APIs
                                                                          • GlobalAlloc.KERNELBASE(00000000,0258FAB4,?,?,?,?,?,?,00426B36,000000FF), ref: 0041FD31
                                                                          • _memset.LIBCMT ref: 0041FFC4
                                                                          • VirtualProtect.KERNELBASE(00445844,0258FAB4,00000040,?,?,?,?,?,?,?,00426B36,000000FF), ref: 0042005E
                                                                          • _memset.LIBCMT ref: 00420175
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376500114.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_409000_file.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$AllocGlobalProtectVirtual
                                                                          • String ID: t^:
                                                                          • API String ID: 2887094141-1317908726
                                                                          • Opcode ID: 64f062d5f2345590aa9a0469f82127ff730fecd29448b75c77babf8d5ce5ac11
                                                                          • Instruction ID: 4d88abe2ad6ecb1d2f0cef97b172de32eaa66621f8e2c620f08c18acbdb3642f
                                                                          • Opcode Fuzzy Hash: 64f062d5f2345590aa9a0469f82127ff730fecd29448b75c77babf8d5ce5ac11
                                                                          • Instruction Fuzzy Hash: EF02C771644340AFE320DF50DD45FAB77A8EB88B01F00453AF789AA5E1D7B45948CB6A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00409000 Relevance: 3.1, APIs: 2, Instructions: 96COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 430 409000-40900d call 40af4e 433 409031-409059 430->433 434 40900f-409012 call 409a06 430->434 440 40905b-40905f 433->440 436 409017-40901d 434->436 438 409060-409075 436->438 439 40901f-40902c call 40af69 436->439 438->440 444 409077-40909e 439->444 445 40902e 439->445 448 4090a0-4090a7 444->448 449 4090a9-4090ad 444->449 445->433 448->449 450 4090c3-4090c7 449->450 451 4090af-4090c1 449->451 453 4090d2-4090db 450->453 454 4090c9-4090cf 450->454 452 4090dd-4090df 451->452 452->449 455 4090e1-4090e5 452->455 453->452 456 409118-40911b 453->456 454->453 457 4090e7-4090eb 455->457 458 4090ed-4090ef 455->458 459 4090f7 456->459 457->449 457->458 458->459 460 4090f1-4090f3 458->460 461 4090fb-409100 459->461 460->459 462 409106-40910c 461->462 463 4091cb-4091d0 461->463 466 409113-409116 462->466 467 40910e-409111 462->467 464 4091d2 463->464 465 4091d4-4091d9 463->465 464->465 466->462 467->466 468 40911d-409120 467->468 468->463 469 409126-409129 468->469 470 409134 469->470 471 40912b-409132 469->471 472 409136-40913b 470->472 471->470 473 409141-409145 472->473 474 409147-40914b 473->474 475 40913d-409140 473->475 476 409185-409187 474->476 477 40914d-409150 474->477 475->473 478 409175-409178 476->478 479 409189-40918f 476->479 480 409171-409173 477->480 481 409152-409156 477->481 482 409183 478->482 483 40917a-409180 478->483 484 409191-409194 479->484 485 4091b5-4091b7 479->485 480->476 486 409164-40916e 481->486 487 409158-40915d 481->487 482->476 483->482 491 4091a0-4091a2 484->491 492 409196-409199 484->492 489 4091c1-4091c6 485->489 490 4091b9-4091be 485->490 486->480 487->486 488 40915f-409162 487->488 488->480 489->461 490->489 494 4091b0-4091b3 491->494 495 4091a4-4091a6 491->495 492->485 493 40919b-40919e 492->493 493->485 493->491 494->472 496 4091a8-4091ab 495->496 497 4091ae 495->497 496->497 497->494
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376500114.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_409000_file.jbxd
                                                                          Similarity
                                                                          • API ID: __calloc_crt_wcslen
                                                                          • String ID:
                                                                          • API String ID: 1967191558-0
                                                                          • Opcode ID: 2b69e31ebb757f3241807583aba67e460f45c8d47572196a43e1016d6c736557
                                                                          • Instruction ID: 74ba5b3e77b594f4c12dd2bfd6f541060c398d67fee77019d7960522efe71db3
                                                                          • Opcode Fuzzy Hash: 2b69e31ebb757f3241807583aba67e460f45c8d47572196a43e1016d6c736557
                                                                          • Instruction Fuzzy Hash: 16210972A04305ABEB245B25D80576773B1EF91324F24803FE411AB2D6EBB99C85C699
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040BF56 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 517 40bf56-40bf60 518 40bf62-40bf6c 517->518 519 40bf7d-40bf86 517->519 518->519 520 40bf6e-40bf7c 518->520 521 40bf88 519->521 522 40bf89-40bf8e 519->522 521->522 523 40bf90-40bfa1 RtlAllocateHeap 522->523 524 40bfa3-40bfaa 522->524 523->524 528 40bfd5-40bfd7 523->528 525 40bfc8-40bfcd 524->525 526 40bfac-40bfb5 524->526 525->528 529 40bfcf 525->529 526->522 531 40bfb7-40bfbc 526->531 529->528 532 40bfc4-40bfc6 531->532 533 40bfbe 531->533 532->528 533->532
                                                                          APIs
                                                                          • RtlAllocateHeap.NTDLL(00000008,00000020,00000000,?,00409A1C,00000040,00000020,00000000,?,00000020,?,004092FE,00000020,00000040), ref: 0040BF99
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376500114.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_409000_file.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateHeap
                                                                          • String ID:
                                                                          • API String ID: 1279760036-0
                                                                          • Opcode ID: ff520d983ba923edfa77cc8519a7c23cd44c775fd86c5617328a32432053a8b2
                                                                          • Instruction ID: 3e13c23398aee7c4ab0612012660ccdc6fea9f14b5978abf0396642290d67cb2
                                                                          • Opcode Fuzzy Hash: ff520d983ba923edfa77cc8519a7c23cd44c775fd86c5617328a32432053a8b2
                                                                          • Instruction Fuzzy Hash: 41019A352412179AEB299F25DC14B6B3794EF91760F01453AE815EB2D0DB78D800CA8C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00409288 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 534 409288-409297 536 409299-40929c 534->536 537 40929d-4092a0 534->537 538 4092b2-4092ba call 4099c1 537->538 539 4092a2-4092a8 537->539 542 4092bf-4092c4 538->542 539->539 540 4092aa-4092b0 539->540 540->538 540->539 543 4092d3-4092de call 409660 542->543 544 4092c6-4092d2 542->544 543->544
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376500114.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_409000_file.jbxd
                                                                          Similarity
                                                                          • API ID: __malloc_crt
                                                                          • String ID:
                                                                          • API String ID: 3464615804-0
                                                                          • Opcode ID: 403c2ad43a9f4e600e0313cd2591e399c7dc17969520facd05e302f34a16ea4d
                                                                          • Instruction ID: fbe5c6cc86f290c003add0f0b008c0e480a0748d0880f70f9af72f86b810f20f
                                                                          • Opcode Fuzzy Hash: 403c2ad43a9f4e600e0313cd2591e399c7dc17969520facd05e302f34a16ea4d
                                                                          • Instruction Fuzzy Hash: 39F0E977504110BACB306B35BC498573768CAD532430A48BFF411E33C6F63C8D8183A9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FAB0 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 548 41fab0-41fb0f LoadLibraryW
                                                                          APIs
                                                                          • LoadLibraryW.KERNELBASE(02585AF0,004200AE,?,?,?,?,?,?,00426B36,000000FF), ref: 0041FB09
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376500114.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_409000_file.jbxd
                                                                          Similarity
                                                                          • API ID: LibraryLoad
                                                                          • String ID:
                                                                          • API String ID: 1029625771-0
                                                                          • Opcode ID: ffa5ea25626978d8626c94f6db186445629982501deb488101e8728f6598ef05
                                                                          • Instruction ID: 74e001d9fec3273e2491562f91ac5844f058a6ed750d37c759427d152c201fb2
                                                                          • Opcode Fuzzy Hash: ffa5ea25626978d8626c94f6db186445629982501deb488101e8728f6598ef05
                                                                          • Instruction Fuzzy Hash: 29E0E564A94241CAE7089F10E8D4B103622FB20702FC26819A026AB651F7F6042CEB1D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 65sleepCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 549 401932-40197e 557 401981-4019a3 call 4011f5 Sleep call 401467 549->557 558 40196f-40197a 549->558 563 4019b2-4019f7 call 4011f5 557->563 564 4019a5-4019ad call 401558 557->564 558->557 564->563
                                                                          APIs
                                                                          • Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E
                                                                            • Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                            • Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDuplicateObjectSectionSleep
                                                                          • String ID:
                                                                          • API String ID: 4152845823-0
                                                                          • Opcode ID: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
                                                                          • Instruction ID: f289286abcb0c8361d5bc883c0512fb430ce21eb2a0d87beead029bdd4c1ea53
                                                                          • Opcode Fuzzy Hash: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
                                                                          • Instruction Fuzzy Hash: 6C11C2F1208204F7E7006A959D62E7A3669AB01714F304137BA43790F1D57D9913E76F
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040193D Relevance: 1.3, APIs: 1, Instructions: 60sleepCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 578 40193d-40197e 581 401981-4019a3 call 4011f5 Sleep call 401467 578->581 582 40196f-40197a 578->582 587 4019b2-4019f7 call 4011f5 581->587 588 4019a5-4019ad call 401558 581->588 582->581 588->587
                                                                          APIs
                                                                          • Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E
                                                                            • Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                            • Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDuplicateObjectSectionSleep
                                                                          • String ID:
                                                                          • API String ID: 4152845823-0
                                                                          • Opcode ID: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
                                                                          • Instruction ID: 515f5f5985279033342f6d13e0d75d2e799464d7355665022411b06cc3c0c42c
                                                                          • Opcode Fuzzy Hash: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
                                                                          • Instruction Fuzzy Hash: 991129F2608285EBD7005BA18DA2EA937659F01710F20057BF6037E0F2D53D9513EB1B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040196C Relevance: 1.3, APIs: 1, Instructions: 48sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E
                                                                            • Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                            • Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376496602.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_400000_file.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDuplicateObjectSectionSleep
                                                                          • String ID:
                                                                          • API String ID: 4152845823-0
                                                                          • Opcode ID: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
                                                                          • Instruction ID: 3e47f40c2c79a3419effdd93610d16f961f2ccd470e9348de27537ec9d0296a5
                                                                          • Opcode Fuzzy Hash: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
                                                                          • Instruction Fuzzy Hash: CA01F2B2208244EFCB005BE58CA1EAA3765AB05315F300133F603B90F2C93C8512EB6B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 00421E67 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000001.00000002.376500114.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_1_2_409000_file.jbxd
                                                                          Similarity
                                                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                          • String ID:
                                                                          • API String ID: 3016257755-0
                                                                          • Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
                                                                          • Instruction ID: ec34d7041dbb63c1802e3ad610614212a93cadf0636924c1052b60e3f4483d9b
                                                                          • Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
                                                                          • Instruction Fuzzy Hash: 5F11837210015AFBCF125E85EC41CEF3F26BB68354F9A8516FE1854130D33AC972AB85
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Execution Graph

                                                                          Execution Coverage:3.6%
                                                                          Dynamic/Decrypted Code Coverage:65.8%
                                                                          Signature Coverage:0%
                                                                          Total number of Nodes:79
                                                                          Total number of Limit Nodes:6
                                                                          execution_graph 7121 409000 7122 409005 _wcslen 7121->7122 7124 409017 7122->7124 7125 409a06 7122->7125 7126 409a0f 7125->7126 7128 409a4c 7126->7128 7129 40bf56 7126->7129 7128->7124 7132 40bf62 7129->7132 7130 40bf90 RtlAllocateHeap 7131 40bf6e 7130->7131 7130->7132 7131->7126 7132->7130 7132->7131 7172 4092e0 7173 4092f3 7172->7173 7174 409a06 __calloc_crt RtlAllocateHeap 7173->7174 7176 4092fe 7174->7176 7175 409a06 __calloc_crt RtlAllocateHeap 7175->7176 7176->7175 7177 409306 7176->7177 7194 402d40 7195 402d65 7194->7195 7196 402f37 7195->7196 7197 401932 8 API calls 7195->7197 7197->7196 7238 401523 7239 401529 7238->7239 7240 401608 NtDuplicateObject 7239->7240 7249 401724 7239->7249 7241 401625 NtCreateSection 7240->7241 7240->7249 7242 4016a5 NtCreateSection 7241->7242 7243 40164b NtMapViewOfSection 7241->7243 7244 4016d1 7242->7244 7242->7249 7243->7242 7245 40166e NtMapViewOfSection 7243->7245 7246 4016db NtMapViewOfSection 7244->7246 7244->7249 7245->7242 7247 40168c 7245->7247 7248 401702 NtMapViewOfSection 7246->7248 7246->7249 7247->7242 7248->7249 7198 401749 7199 4016cf 7198->7199 7200 4016db NtMapViewOfSection 7199->7200 7202 401724 7199->7202 7201 401702 NtMapViewOfSection 7200->7201 7200->7202 7201->7202 7133 4201b0 7134 4201d0 7133->7134 7137 41fb60 7134->7137 7136 420d63 7139 41fb86 __write_nolock 7137->7139 7138 41fd29 GlobalAlloc 7143 41fd47 _memset 7138->7143 7139->7138 7140 420043 VirtualProtect 7141 420069 7140->7141 7145 41fab0 LoadLibraryW 7141->7145 7143->7140 7144 4200ae _memset 7144->7136 7145->7144 7146 402e9b 7149 402ea1 7146->7149 7147 402f37 7149->7147 7150 401932 7149->7150 7151 401943 7150->7151 7152 401986 Sleep 7151->7152 7153 4019a1 7152->7153 7155 4019b2 7153->7155 7156 401558 7153->7156 7155->7147 7157 401567 7156->7157 7158 401608 NtDuplicateObject 7157->7158 7162 401724 7157->7162 7159 401625 NtCreateSection 7158->7159 7158->7162 7160 4016a5 NtCreateSection 7159->7160 7161 40164b NtMapViewOfSection 7159->7161 7160->7162 7163 4016d1 7160->7163 7161->7160 7164 40166e NtMapViewOfSection 7161->7164 7162->7155 7163->7162 7165 4016db NtMapViewOfSection 7163->7165 7164->7160 7166 40168c 7164->7166 7165->7162 7167 401702 NtMapViewOfSection 7165->7167 7166->7160 7167->7162 7233 402d7d 7234 402d83 7233->7234 7236 402deb 7233->7236 7235 401932 8 API calls 7237 402f37 7235->7237 7236->7235 7236->7237 7250 40193d 7251 40196a 7250->7251 7252 401986 Sleep 7251->7252 7253 4019a1 7252->7253 7254 401558 7 API calls 7253->7254 7255 4019b2 7253->7255 7254->7255

                                                                          Executed Functions

                                                                          Function 00401558 Relevance: 10.7, APIs: 7, Instructions: 206nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 0 401558-4015b2 call 4011f5 12 4015b4 0->12 13 4015b7-4015bc 0->13 12->13 15 4015c2-4015d3 13->15 16 4018d7-4018df 13->16 19 4018d5 15->19 20 4015d9-401602 15->20 16->13 21 4018e4-40192f call 4011f5 16->21 19->21 20->19 28 401608-40161f NtDuplicateObject 20->28 28->19 30 401625-401649 NtCreateSection 28->30 32 4016a5-4016cb NtCreateSection 30->32 33 40164b-40166c NtMapViewOfSection 30->33 32->19 35 4016d1-4016d5 32->35 33->32 36 40166e-40168a NtMapViewOfSection 33->36 35->19 38 4016db-4016fc NtMapViewOfSection 35->38 36->32 39 40168c-4016a2 36->39 38->19 42 401702-40171e NtMapViewOfSection 38->42 39->32 42->19 45 401724 42->45 45->19 46 401724 call 401729 45->46 46->19
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
                                                                          • Instruction ID: 4afb5ad6e9f78dbb0f0fc4dd380045413720c66cee1019041566b0107d6eeca4
                                                                          • Opcode Fuzzy Hash: 94fb41d671dbeab80d9278360f7b723801272b6da464276eb8e79f9657775aa6
                                                                          • Instruction Fuzzy Hash: 2F615E71900208FBEB209F91CC49FAF7BB8EF85B14F10412AF912BA1E5D6749901DB66
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401564 Relevance: 10.7, APIs: 7, Instructions: 175nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 47 401564-4015b2 call 4011f5 57 4015b4 47->57 58 4015b7-4015bc 47->58 57->58 60 4015c2-4015d3 58->60 61 4018d7-4018df 58->61 64 4018d5 60->64 65 4015d9-401602 60->65 61->58 66 4018e4-40192f call 4011f5 61->66 64->66 65->64 73 401608-40161f NtDuplicateObject 65->73 73->64 75 401625-401649 NtCreateSection 73->75 77 4016a5-4016cb NtCreateSection 75->77 78 40164b-40166c NtMapViewOfSection 75->78 77->64 80 4016d1-4016d5 77->80 78->77 81 40166e-40168a NtMapViewOfSection 78->81 80->64 83 4016db-4016fc NtMapViewOfSection 80->83 81->77 84 40168c-4016a2 81->84 83->64 87 401702-40171e NtMapViewOfSection 83->87 84->77 87->64 90 401724 87->90 90->64 91 401724 call 401729 90->91 91->64
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
                                                                          • Instruction ID: 3c61d4fa49215657d74707620d36eaa57d50516e3f831c539a14d6838cb40392
                                                                          • Opcode Fuzzy Hash: 25fb98b4f42f8453298f183ae8c9fe853ab2af685c4accb6617153fec11399dc
                                                                          • Instruction Fuzzy Hash: 23513CB1900249FBEB209F91CC49FAF7BB8EF85710F14412AF911BA1E5D6749941CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401577 Relevance: 10.7, APIs: 7, Instructions: 168nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 132 401577-4015b2 call 4011f5 139 4015b4 132->139 140 4015b7-4015bc 132->140 139->140 142 4015c2-4015d3 140->142 143 4018d7-4018df 140->143 146 4018d5 142->146 147 4015d9-401602 142->147 143->140 148 4018e4-40192f call 4011f5 143->148 146->148 147->146 155 401608-40161f NtDuplicateObject 147->155 155->146 157 401625-401649 NtCreateSection 155->157 159 4016a5-4016cb NtCreateSection 157->159 160 40164b-40166c NtMapViewOfSection 157->160 159->146 162 4016d1-4016d5 159->162 160->159 163 40166e-40168a NtMapViewOfSection 160->163 162->146 165 4016db-4016fc NtMapViewOfSection 162->165 163->159 166 40168c-4016a2 163->166 165->146 169 401702-40171e NtMapViewOfSection 165->169 166->159 169->146 172 401724 169->172 172->146 173 401724 call 401729 172->173 173->146
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
                                                                          • Instruction ID: ba3189e89dbc592d8eefb072767128172b6b3105eb2a85c49d1307986ab5c8dd
                                                                          • Opcode Fuzzy Hash: 083574d86fbacfeeee5c63ee9eae41342103da8b89c03bac49e39559cf037064
                                                                          • Instruction Fuzzy Hash: 9D511B71900249BFEB209F91CC48FAF7BB8FF85B14F10412AFA11BA1E5D6749941CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401523 Relevance: 10.7, APIs: 7, Instructions: 168nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 92 401523-401527 93 401529-40152e 92->93 94 40159f-4015b2 call 4011f5 92->94 93->94 97 4015b4 94->97 98 4015b7-4015bc 94->98 97->98 100 4015c2-4015d3 98->100 101 4018d7-4018df 98->101 104 4018d5 100->104 105 4015d9-401602 100->105 101->98 106 4018e4-40192f call 4011f5 101->106 104->106 105->104 113 401608-40161f NtDuplicateObject 105->113 113->104 115 401625-401649 NtCreateSection 113->115 117 4016a5-4016cb NtCreateSection 115->117 118 40164b-40166c NtMapViewOfSection 115->118 117->104 120 4016d1-4016d5 117->120 118->117 121 40166e-40168a NtMapViewOfSection 118->121 120->104 123 4016db-4016fc NtMapViewOfSection 120->123 121->117 124 40168c-4016a2 121->124 123->104 127 401702-40171e NtMapViewOfSection 123->127 124->117 127->104 130 401724 127->130 130->104 131 401724 call 401729 130->131 131->104
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$CreateDuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 3617974760-0
                                                                          • Opcode ID: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
                                                                          • Instruction ID: c9dca56e4daa214b2bd9150ebf0f157daf6c833c296841cdcd3f7df5e4c146b1
                                                                          • Opcode Fuzzy Hash: f2a4be680cfb18686692e1608cce56726be6b364057ceed8b4cf4ca6dcfe5132
                                                                          • Instruction Fuzzy Hash: 91510A71900249BFEB209F92CC48F9FBBB8FF85B14F14411AFA11BA2A5D7749945CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040158C Relevance: 10.7, APIs: 7, Instructions: 168nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 174 40158c-4015b2 call 4011f5 178 4015b4 174->178 179 4015b7-4015bc 174->179 178->179 181 4015c2-4015d3 179->181 182 4018d7-4018df 179->182 185 4018d5 181->185 186 4015d9-401602 181->186 182->179 187 4018e4-40192f call 4011f5 182->187 185->187 186->185 194 401608-40161f NtDuplicateObject 186->194 194->185 196 401625-401649 NtCreateSection 194->196 198 4016a5-4016cb NtCreateSection 196->198 199 40164b-40166c NtMapViewOfSection 196->199 198->185 201 4016d1-4016d5 198->201 199->198 202 40166e-40168a NtMapViewOfSection 199->202 201->185 204 4016db-4016fc NtMapViewOfSection 201->204 202->198 205 40168c-4016a2 202->205 204->185 208 401702-40171e NtMapViewOfSection 204->208 205->198 208->185 211 401724 208->211 211->185 212 401724 call 401729 211->212 212->185
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
                                                                          • Instruction ID: 02d2e3ac3767ea31e924919402f7a0ff100aaf9667a8aefd77e34752db93229b
                                                                          • Opcode Fuzzy Hash: c7db028f8420b358ec692813db1bfb5c9bff11339c6e47bbd5ed771e3bdbe30c
                                                                          • Instruction Fuzzy Hash: C9513AB1900249BFEB209F92CC48F9FBBB8FF85B14F10415AFA11AA1E5D7749944CB20
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401585 Relevance: 10.7, APIs: 7, Instructions: 165nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 213 401585-4015b2 call 4011f5 220 4015b4 213->220 221 4015b7-4015bc 213->221 220->221 223 4015c2-4015d3 221->223 224 4018d7-4018df 221->224 227 4018d5 223->227 228 4015d9-401602 223->228 224->221 229 4018e4-40192f call 4011f5 224->229 227->229 228->227 236 401608-40161f NtDuplicateObject 228->236 236->227 238 401625-401649 NtCreateSection 236->238 240 4016a5-4016cb NtCreateSection 238->240 241 40164b-40166c NtMapViewOfSection 238->241 240->227 243 4016d1-4016d5 240->243 241->240 244 40166e-40168a NtMapViewOfSection 241->244 243->227 246 4016db-4016fc NtMapViewOfSection 243->246 244->240 247 40168c-4016a2 244->247 246->227 250 401702-40171e NtMapViewOfSection 246->250 247->240 250->227 253 401724 250->253 253->227 254 401724 call 401729 253->254 254->227
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
                                                                          • Instruction ID: 9d9f292dd7e40d4d2d6115b75542e29ae97a3c703512c5fffb38717ec82669a3
                                                                          • Opcode Fuzzy Hash: 23d6bc309405edc7f8da1be2c541e8d9f5b1e81b56b2c35d9e42197813f8af09
                                                                          • Instruction Fuzzy Hash: 36511A75900249BFEB209F91CC48FAF7BB8FF85B14F10416AFA11BA1A5D6749941CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040159A Relevance: 10.7, APIs: 7, Instructions: 160nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 255 40159a-4015b2 call 4011f5 259 4015b4 255->259 260 4015b7-4015bc 255->260 259->260 262 4015c2-4015d3 260->262 263 4018d7-4018df 260->263 266 4018d5 262->266 267 4015d9-401602 262->267 263->260 268 4018e4-40192f call 4011f5 263->268 266->268 267->266 275 401608-40161f NtDuplicateObject 267->275 275->266 277 401625-401649 NtCreateSection 275->277 279 4016a5-4016cb NtCreateSection 277->279 280 40164b-40166c NtMapViewOfSection 277->280 279->266 282 4016d1-4016d5 279->282 280->279 283 40166e-40168a NtMapViewOfSection 280->283 282->266 285 4016db-4016fc NtMapViewOfSection 282->285 283->279 286 40168c-4016a2 283->286 285->266 289 401702-40171e NtMapViewOfSection 285->289 286->279 289->266 292 401724 289->292 292->266 293 401724 call 401729 292->293 293->266
                                                                          APIs
                                                                          • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                          • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401667
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401685
                                                                          • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016C6
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: Section$View$Create$DuplicateObject
                                                                          • String ID:
                                                                          • API String ID: 1546783058-0
                                                                          • Opcode ID: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
                                                                          • Instruction ID: 1cd82c906aaffff485458f801d6ba595cb0416390f7e33d4f9d681d8d529f326
                                                                          • Opcode Fuzzy Hash: 4dff7dc5d51454a43d874152b5abf798c4daef4429b50565c24c7d2891ff9f85
                                                                          • Instruction Fuzzy Hash: BF510971900249BFEB209F92CC48F9FBBB8FF85B14F104159FA11AA2A5D6749940CB24
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401749 Relevance: 3.0, APIs: 2, Instructions: 40nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 498 401749-40174c 500 4018d5-40192f call 4011f5 498->500 501 4016db-4016fc NtMapViewOfSection 498->501 501->500 502 401702-40171e NtMapViewOfSection 501->502 502->500 504 401724 502->504 504->500 506 401724 call 401729 504->506 506->500
                                                                          APIs
                                                                          • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016F7
                                                                          • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401719
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: SectionView
                                                                          • String ID:
                                                                          • API String ID: 1323581903-0
                                                                          • Opcode ID: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
                                                                          • Instruction ID: 088a864a315bec2a81033f27f4cad91d314b4a72151043dcf738e9c9ac7e5ebb
                                                                          • Opcode Fuzzy Hash: 645c41685cf09351304fde75ab205f83a01d627caff4926b51e1c70b330bbf47
                                                                          • Instruction Fuzzy Hash: 0E011475500288FEEB219F92CC49FAF7FB9EF82B10F08016AF510B61E5E2714980CB20
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FB60 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 466memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 294 41fb60-41fb9a call 40d430 297 41fba0-41fba6 294->297 298 41fba8-41fbab 297->298 299 41fbae-41fbb4 297->299 298->299 300 41fbb6-41fbbe 299->300 301 41fbca-41fbd1 299->301 300->301 303 41fbc0-41fbc8 300->303 301->297 304 41fbd3-41fbdd 301->304 303->301 303->304 305 41fbe3-41fc41 304->305 306 41fcd9-41fced 304->306 347 41fc44-41fc49 305->347 307 41fcf0-41fcf6 306->307 308 41fd03-41fd0a 307->308 309 41fcf8-41fcfd 307->309 311 41fd20-41fd27 308->311 312 41fd0c-41fd1d 308->312 309->308 311->307 313 41fd29-41fd45 GlobalAlloc 311->313 312->311 316 41fd47-41fd4d 313->316 317 41fd8d-41fd90 313->317 320 41fd53-41fd58 316->320 318 41fe85-41fe9d 317->318 319 41fd96-41fe80 317->319 323 41fea5-41fea8 318->323 319->318 324 41fd60-41fd6d call 41f820 320->324 325 41fd5a-41fd5e 320->325 328 41fed8-41fedd 323->328 329 41feaa-41fed3 323->329 337 41fd88-41fd8b 324->337 338 41fd6f-41fd83 324->338 325->324 332 41fee3-41ffe4 call 4095e0 328->332 333 41ffe9-41ffed 328->333 329->328 332->333 333->323 336 41fff3-42000a 333->336 342 420010-420023 336->342 337->317 337->320 338->337 368 420025-42002b 342->368 347->347 351 41fc4b-41fc52 347->351 352 41fc54 351->352 353 41fc5e-41fc61 351->353 352->353 357 41fc71-41fc73 353->357 358 41fc63-41fc6f 353->358 361 41fc80-41fc8a 357->361 362 41fc75-41fc79 357->362 363 41fc7e 358->363 364 41fcbb-41fcbf 361->364 365 41fc8c-41fc94 361->365 362->363 363->361 371 41fcc1-41fccb 364->371 372 41fcce-41fcd3 364->372 369 41fc96 365->369 370 41fc9a-41fcb1 call 409660 365->370 374 420030-42003a 368->374 369->370 385 41fcb3 370->385 386 41fcb7 370->386 371->372 372->306 375 420040-420041 374->375 376 42003c 374->376 375->374 379 420043-420071 VirtualProtect call 41fb10 375->379 376->375 390 420076-42007c 379->390 385->386 386->364 393 42008e-420094 390->393 394 42007e-42008a 390->394 395 4200a0-4200a7 393->395 396 420096 393->396 394->393 395->390 399 4200a9 call 41fab0 395->399 396->395 403 4200ae-4200b8 399->403 405 4200be-420187 call 4095e0 403->405 406 42018f-4201a6 403->406 405->406
                                                                          APIs
                                                                          • GlobalAlloc.KERNELBASE(00000000,0258FAB4,?,?,?,?,?,?,00426B36,000000FF), ref: 0041FD31
                                                                          • _memset.LIBCMT ref: 0041FFC4
                                                                          • VirtualProtect.KERNELBASE(00445844,0258FAB4,00000040,?,?,?,?,?,?,?,00426B36,000000FF), ref: 0042005E
                                                                          • _memset.LIBCMT ref: 00420175
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428525605.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_409000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$AllocGlobalProtectVirtual
                                                                          • String ID: t^:
                                                                          • API String ID: 2887094141-1317908726
                                                                          • Opcode ID: 64f062d5f2345590aa9a0469f82127ff730fecd29448b75c77babf8d5ce5ac11
                                                                          • Instruction ID: 4d88abe2ad6ecb1d2f0cef97b172de32eaa66621f8e2c620f08c18acbdb3642f
                                                                          • Opcode Fuzzy Hash: 64f062d5f2345590aa9a0469f82127ff730fecd29448b75c77babf8d5ce5ac11
                                                                          • Instruction Fuzzy Hash: EF02C771644340AFE320DF50DD45FAB77A8EB88B01F00453AF789AA5E1D7B45948CB6A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00409000 Relevance: 3.1, APIs: 2, Instructions: 96COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 430 409000-40900d call 40af4e 433 409031-409059 430->433 434 40900f-409012 call 409a06 430->434 440 40905b-40905f 433->440 436 409017-40901d 434->436 438 409060-409075 436->438 439 40901f-40902c call 40af69 436->439 438->440 444 409077-40909e 439->444 445 40902e 439->445 448 4090a0-4090a7 444->448 449 4090a9-4090ad 444->449 445->433 448->449 450 4090c3-4090c7 449->450 451 4090af-4090c1 449->451 453 4090d2-4090db 450->453 454 4090c9-4090cf 450->454 452 4090dd-4090df 451->452 452->449 455 4090e1-4090e5 452->455 453->452 456 409118-40911b 453->456 454->453 457 4090e7-4090eb 455->457 458 4090ed-4090ef 455->458 459 4090f7 456->459 457->449 457->458 458->459 460 4090f1-4090f3 458->460 461 4090fb-409100 459->461 460->459 462 409106-40910c 461->462 463 4091cb-4091d0 461->463 466 409113-409116 462->466 467 40910e-409111 462->467 464 4091d2 463->464 465 4091d4-4091d9 463->465 464->465 466->462 467->466 468 40911d-409120 467->468 468->463 469 409126-409129 468->469 470 409134 469->470 471 40912b-409132 469->471 472 409136-40913b 470->472 471->470 473 409141-409145 472->473 474 409147-40914b 473->474 475 40913d-409140 473->475 476 409185-409187 474->476 477 40914d-409150 474->477 475->473 478 409175-409178 476->478 479 409189-40918f 476->479 480 409171-409173 477->480 481 409152-409156 477->481 482 409183 478->482 483 40917a-409180 478->483 484 409191-409194 479->484 485 4091b5-4091b7 479->485 480->476 486 409164-40916e 481->486 487 409158-40915d 481->487 482->476 483->482 491 4091a0-4091a2 484->491 492 409196-409199 484->492 489 4091c1-4091c6 485->489 490 4091b9-4091be 485->490 486->480 487->486 488 40915f-409162 487->488 488->480 489->461 490->489 494 4091b0-4091b3 491->494 495 4091a4-4091a6 491->495 492->485 493 40919b-40919e 492->493 493->485 493->491 494->472 496 4091a8-4091ab 495->496 497 4091ae 495->497 496->497 497->494
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428525605.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_409000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: __calloc_crt_wcslen
                                                                          • String ID:
                                                                          • API String ID: 1967191558-0
                                                                          • Opcode ID: 2b69e31ebb757f3241807583aba67e460f45c8d47572196a43e1016d6c736557
                                                                          • Instruction ID: 74ba5b3e77b594f4c12dd2bfd6f541060c398d67fee77019d7960522efe71db3
                                                                          • Opcode Fuzzy Hash: 2b69e31ebb757f3241807583aba67e460f45c8d47572196a43e1016d6c736557
                                                                          • Instruction Fuzzy Hash: 16210972A04305ABEB245B25D80576773B1EF91324F24803FE411AB2D6EBB99C85C699
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040BF56 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 517 40bf56-40bf60 518 40bf62-40bf6c 517->518 519 40bf7d-40bf86 517->519 518->519 522 40bf6e-40bf7c 518->522 520 40bf88 519->520 521 40bf89-40bf8e 519->521 520->521 523 40bf90-40bfa1 RtlAllocateHeap 521->523 524 40bfa3-40bfaa 521->524 523->524 526 40bfd5-40bfd7 523->526 527 40bfc8-40bfcd 524->527 528 40bfac-40bfb5 524->528 527->526 529 40bfcf 527->529 528->521 531 40bfb7-40bfbc 528->531 529->526 532 40bfc4-40bfc6 531->532 533 40bfbe 531->533 532->526 533->532
                                                                          APIs
                                                                          • RtlAllocateHeap.NTDLL(00000008,00000020,00000000,?,00409A1C,00000040,00000020,00000000,?,00000020,?,004092FE,00000020,00000040), ref: 0040BF99
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428525605.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_409000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateHeap
                                                                          • String ID:
                                                                          • API String ID: 1279760036-0
                                                                          • Opcode ID: ff520d983ba923edfa77cc8519a7c23cd44c775fd86c5617328a32432053a8b2
                                                                          • Instruction ID: 3e13c23398aee7c4ab0612012660ccdc6fea9f14b5978abf0396642290d67cb2
                                                                          • Opcode Fuzzy Hash: ff520d983ba923edfa77cc8519a7c23cd44c775fd86c5617328a32432053a8b2
                                                                          • Instruction Fuzzy Hash: 41019A352412179AEB299F25DC14B6B3794EF91760F01453AE815EB2D0DB78D800CA8C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00409288 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 534 409288-409297 536 409299-40929c 534->536 537 40929d-4092a0 534->537 538 4092b2-4092ba call 4099c1 537->538 539 4092a2-4092a8 537->539 542 4092bf-4092c4 538->542 539->539 540 4092aa-4092b0 539->540 540->538 540->539 543 4092d3-4092de call 409660 542->543 544 4092c6-4092d2 542->544 543->544
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428525605.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_409000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: __malloc_crt
                                                                          • String ID:
                                                                          • API String ID: 3464615804-0
                                                                          • Opcode ID: 403c2ad43a9f4e600e0313cd2591e399c7dc17969520facd05e302f34a16ea4d
                                                                          • Instruction ID: fbe5c6cc86f290c003add0f0b008c0e480a0748d0880f70f9af72f86b810f20f
                                                                          • Opcode Fuzzy Hash: 403c2ad43a9f4e600e0313cd2591e399c7dc17969520facd05e302f34a16ea4d
                                                                          • Instruction Fuzzy Hash: 39F0E977504110BACB306B35BC498573768CAD532430A48BFF411E33C6F63C8D8183A9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FAB0 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 548 41fab0-41fb0f LoadLibraryW
                                                                          APIs
                                                                          • LoadLibraryW.KERNELBASE(02585AF0,004200AE,?,?,?,?,?,?,00426B36,000000FF), ref: 0041FB09
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428525605.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_409000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: LibraryLoad
                                                                          • String ID:
                                                                          • API String ID: 1029625771-0
                                                                          • Opcode ID: ffa5ea25626978d8626c94f6db186445629982501deb488101e8728f6598ef05
                                                                          • Instruction ID: 74e001d9fec3273e2491562f91ac5844f058a6ed750d37c759427d152c201fb2
                                                                          • Opcode Fuzzy Hash: ffa5ea25626978d8626c94f6db186445629982501deb488101e8728f6598ef05
                                                                          • Instruction Fuzzy Hash: 29E0E564A94241CAE7089F10E8D4B103622FB20702FC26819A026AB651F7F6042CEB1D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 65sleepCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 549 401932-40197e 557 401981-4019a3 call 4011f5 Sleep call 401467 549->557 558 40196f-40197a 549->558 563 4019b2-4019f7 call 4011f5 557->563 564 4019a5-4019ad call 401558 557->564 558->557 564->563
                                                                          APIs
                                                                          • Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E
                                                                            • Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                            • Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDuplicateObjectSectionSleep
                                                                          • String ID:
                                                                          • API String ID: 4152845823-0
                                                                          • Opcode ID: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
                                                                          • Instruction ID: f289286abcb0c8361d5bc883c0512fb430ce21eb2a0d87beead029bdd4c1ea53
                                                                          • Opcode Fuzzy Hash: 3fc1ef90b2a5b2730ee9b434eeb4b582bf46cdcd1d0460405fd1be13f8c58862
                                                                          • Instruction Fuzzy Hash: 6C11C2F1208204F7E7006A959D62E7A3669AB01714F304137BA43790F1D57D9913E76F
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040193D Relevance: 1.3, APIs: 1, Instructions: 60sleepCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 578 40193d-40197e 581 401981-4019a3 call 4011f5 Sleep call 401467 578->581 582 40196f-40197a 578->582 587 4019b2-4019f7 call 4011f5 581->587 588 4019a5-4019ad call 401558 581->588 582->581 588->587
                                                                          APIs
                                                                          • Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E
                                                                            • Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                            • Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDuplicateObjectSectionSleep
                                                                          • String ID:
                                                                          • API String ID: 4152845823-0
                                                                          • Opcode ID: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
                                                                          • Instruction ID: 515f5f5985279033342f6d13e0d75d2e799464d7355665022411b06cc3c0c42c
                                                                          • Opcode Fuzzy Hash: 886c6b7d3fd93a1d42f8c5386c1713bd20b837ff01857d39e84b1d41efe43a78
                                                                          • Instruction Fuzzy Hash: 991129F2608285EBD7005BA18DA2EA937659F01710F20057BF6037E0F2D53D9513EB1B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040196C Relevance: 1.3, APIs: 1, Instructions: 48sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNELBASE(00001388,000000C5,0000006D), ref: 0040198E
                                                                            • Part of subcall function 00401558: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401617
                                                                            • Part of subcall function 00401558: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401644
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428318712.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_400000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDuplicateObjectSectionSleep
                                                                          • String ID:
                                                                          • API String ID: 4152845823-0
                                                                          • Opcode ID: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
                                                                          • Instruction ID: 3e47f40c2c79a3419effdd93610d16f961f2ccd470e9348de27537ec9d0296a5
                                                                          • Opcode Fuzzy Hash: 54672eb5d74a33a50b4e0698c103b24abf47bf219929af624bad9b05e038b79e
                                                                          • Instruction Fuzzy Hash: CA01F2B2208244EFCB005BE58CA1EAA3765AB05315F300133F603B90F2C93C8512EB6B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 00421E67 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000007.00000002.428525605.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_7_2_409000_jwjrtuw.jbxd
                                                                          Similarity
                                                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                          • String ID:
                                                                          • API String ID: 3016257755-0
                                                                          • Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
                                                                          • Instruction ID: ec34d7041dbb63c1802e3ad610614212a93cadf0636924c1052b60e3f4483d9b
                                                                          • Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
                                                                          • Instruction Fuzzy Hash: 5F11837210015AFBCF125E85EC41CEF3F26BB68354F9A8516FE1854130D33AC972AB85
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Execution Graph

                                                                          Execution Coverage:1.4%
                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                          Signature Coverage:47.2%
                                                                          Total number of Nodes:36
                                                                          Total number of Limit Nodes:8
                                                                          execution_graph 29051 4470630 29052 447064c 29051->29052 29054 4471577 29052->29054 29057 44705b0 29054->29057 29058 44705dc 29057->29058 29059 44705e2 GetFileAttributesA 29058->29059 29060 447061e 29058->29060 29062 4470420 29058->29062 29059->29058 29063 44704f3 29062->29063 29064 44704ff CreateWindowExA 29063->29064 29065 44704fa 29063->29065 29064->29065 29066 4470540 PostMessageA 29064->29066 29065->29058 29067 447055f 29066->29067 29067->29065 29069 4470110 VirtualAlloc GetModuleFileNameA 29067->29069 29070 4470414 29069->29070 29071 447017d CreateProcessA 29069->29071 29070->29067 29071->29070 29073 447025f VirtualFree VirtualAlloc GetThreadContext 29071->29073 29073->29070 29074 44702a9 ReadProcessMemory 29073->29074 29075 44702e5 VirtualAllocEx NtWriteVirtualMemory 29074->29075 29076 44702d5 NtUnmapViewOfSection 29074->29076 29077 447033b 29075->29077 29076->29075 29078 4470350 NtWriteVirtualMemory 29077->29078 29079 447039d WriteProcessMemory SetThreadContext ResumeThread 29077->29079 29078->29077 29080 44703fb ExitProcess 29079->29080 29082 429c026 29083 429c035 29082->29083 29086 429c7c6 29083->29086 29087 429c7e1 29086->29087 29088 429c7ea CreateToolhelp32Snapshot 29087->29088 29089 429c806 Module32First 29087->29089 29088->29087 29088->29089 29090 429c03e 29089->29090 29091 429c815 29089->29091 29093 429c485 29091->29093 29094 429c4b0 29093->29094 29095 429c4f9 29094->29095 29096 429c4c1 VirtualAlloc 29094->29096 29095->29095 29096->29095

                                                                          Executed Functions

                                                                          Function 04470110 Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04470156
                                                                          • GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0447016C
                                                                          • CreateProcessA.KERNELBASE(?,00000000), ref: 04470255
                                                                          • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04470270
                                                                          • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04470283
                                                                          • GetThreadContext.KERNELBASE(00000000,?), ref: 0447029F
                                                                          • ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 044702C8
                                                                          • NtUnmapViewOfSection.NTDLL(00000000,?), ref: 044702E3
                                                                          • VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04470304
                                                                          • NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0447032A
                                                                          • NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04470399
                                                                          • WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 044703BF
                                                                          • SetThreadContext.KERNELBASE(00000000,?), ref: 044703E1
                                                                          • ResumeThread.KERNELBASE(00000000), ref: 044703ED
                                                                          • ExitProcess.KERNEL32(00000000), ref: 04470412
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
                                                                          • String ID:
                                                                          • API String ID: 2875986403-0
                                                                          • Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
                                                                          • Instruction ID: d965b2a5ec1623e2751de69c1ae5a9dcfaad6aa563a179b5fdfaa613be93c189
                                                                          • Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
                                                                          • Instruction Fuzzy Hash: 0AB1B674A00208AFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE42CF94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0429C7C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 41 429c7c6-429c7df 42 429c7e1-429c7e3 41->42 43 429c7ea-429c7f6 CreateToolhelp32Snapshot 42->43 44 429c7e5 42->44 45 429c7f8-429c7fe 43->45 46 429c806-429c813 Module32First 43->46 44->43 45->46 51 429c800-429c804 45->51 47 429c81c-429c824 46->47 48 429c815-429c816 call 429c485 46->48 52 429c81b 48->52 51->42 51->46 52->47
                                                                          APIs
                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0429C7EE
                                                                          • Module32First.KERNEL32(00000000,00000224), ref: 0429C80E
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0429C000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_429c000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                          • String ID:
                                                                          • API String ID: 3833638111-0
                                                                          • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                          • Instruction ID: d1773e4abb3dc673b7ec8a9e12847becf48ed6961a9a0604e62c1b2f14bd2d94
                                                                          • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                          • Instruction Fuzzy Hash: 67F062323107116BEB203BB6A88DAAA76ECBF49725F100668E643D60C0DB70FC454661
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04470420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 15 4470420-44704f8 17 44704ff-447053c CreateWindowExA 15->17 18 44704fa 15->18 20 4470540-4470558 PostMessageA 17->20 21 447053e 17->21 19 44705aa-44705ad 18->19 22 447055f-4470563 20->22 21->19 22->19 23 4470565-4470579 22->23 23->19 25 447057b-4470582 23->25 26 4470584-4470588 25->26 27 44705a8 25->27 26->27 28 447058a-4470591 26->28 27->22 28->27 29 4470593-4470597 call 4470110 28->29 31 447059c-44705a5 29->31 31->27
                                                                          APIs
                                                                          • CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04470533
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateWindow
                                                                          • String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
                                                                          • API String ID: 716092398-2341455598
                                                                          • Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
                                                                          • Instruction ID: 831ec4095c5af408b837a779c1113612204b5467f345bb84d2e5f1eab045041f
                                                                          • Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
                                                                          • Instruction Fuzzy Hash: 1F511A70D09388DAEF11CBD8C849BDEBFB2AF11708F144059D5447F286C3BA6659CBA6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 044705B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 32 44705b0-44705d5 33 44705dc-44705e0 32->33 34 44705e2-44705f5 GetFileAttributesA 33->34 35 447061e-4470621 33->35 36 44705f7-44705fe 34->36 37 4470613-447061c 34->37 36->37 38 4470600-447060b call 4470420 36->38 37->33 40 4470610 38->40 40->37
                                                                          APIs
                                                                          • GetFileAttributesA.KERNELBASE(apfHQ), ref: 044705EC
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AttributesFile
                                                                          • String ID: apfHQ$o
                                                                          • API String ID: 3188754299-2999369273
                                                                          • Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
                                                                          • Instruction ID: f66c823accf28de54a19cc055c14dc85b933f389de5b1bb0ee90d5fa8ea39877
                                                                          • Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
                                                                          • Instruction Fuzzy Hash: 61011E70C0524CEADF10DB98C5583EEBFB5AF41308F148099C4092B342D7769B59CBA1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0429C485 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 54 429c485-429c4bf call 429c798 57 429c50d 54->57 58 429c4c1-429c4f4 VirtualAlloc call 429c512 54->58 57->57 60 429c4f9-429c50b 58->60 60->57
                                                                          APIs
                                                                          • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0429C4D6
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0429C000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_429c000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocVirtual
                                                                          • String ID:
                                                                          • API String ID: 4275171209-0
                                                                          • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                          • Instruction ID: 28399c0c027cc9261420273088dda300f2b4fb1cabbe1e79f73bdb5e03ead0e8
                                                                          • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                          • Instruction Fuzzy Hash: FA113C79A00208EFDB01DF99C985E99BBF5AF08350F058094F948AB361D371EA90DF80
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 0429D71C Relevance: .1, Instructions: 105COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0429C000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_429c000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
                                                                          • Instruction ID: f96def537107c9d03f6fc9bebcdfa57c2ee669dea54b1736c30f96287e5e7ffe
                                                                          • Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
                                                                          • Instruction Fuzzy Hash: 5A314639A262469FCF15CE70D890AB5BBB0FF87224F1899DCD0818B106E235644BE794
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0429C0A3 Relevance: .1, Instructions: 61COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419328976.000000000429C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0429C000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_429c000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                                          • Instruction ID: d9f1a837902ff81bf888742a0567f2a716832f9436e73e81a2f1aa2fc9042edb
                                                                          • Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                                          • Instruction Fuzzy Hash: A4118272350101AFDB54DF56DC81FA673EAEB89320B198065ED08CB316E676EC42C760
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04470042 Relevance: .1, Instructions: 61COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                                          • Instruction ID: a7ee146163326fc5eac195758bf0897357e1497c2c1e610beaafc12f7ef56225
                                                                          • Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                                          • Instruction Fuzzy Hash: 931170723411009FEB54DE65EC90EE773EAEB89234B198156E908CB312E675E802C760
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04496437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 548 4496437-4496440 549 4496442-4496446 548->549 550 4496466 548->550 549->550 552 4496448-4496459 call 4499636 549->552 551 4496468-449646b 550->551 555 449645b-4496460 call 4495ba8 552->555 556 449646c-449647d call 4499636 552->556 555->550 561 4496488-449649a call 4499636 556->561 562 449647f-4496480 call 449158d 556->562 567 44964ac-44964cd call 4495f4c call 4496837 561->567 568 449649c-44964aa call 449158d * 2 561->568 565 4496485-4496486 562->565 565->555 577 44964cf-44964dd call 449557d 567->577 578 44964e2-4496500 call 449158d call 4494edc call 4494d82 call 449158d 567->578 568->565 583 44964df 577->583 584 4496502-4496505 577->584 586 4496507-4496509 578->586 583->578 584->586 586->551
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
                                                                          • String ID:
                                                                          • API String ID: 1442030790-0
                                                                          • Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                          • Instruction ID: a9deffc859dbd44fac43a99958557cc9b4f1a502184942eae64d38d0fd97e80d
                                                                          • Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                          • Instruction Fuzzy Hash: E621D431104601ABFF327FA6D902D0B7FD4DF41764B52841FE444551A2EA32BD01FA55
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04493F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 592 4493f16-4493f2f 593 4493f49-4493f5e call 449bdc0 592->593 594 4493f31-4493f3b call 4495ba8 call 4494c72 592->594 593->594 599 4493f60-4493f63 593->599 603 4493f40 594->603 601 4493f65 599->601 602 4493f77-4493f7d 599->602 605 4493f6b-4493f75 call 4495ba8 601->605 606 4493f67-4493f69 601->606 607 4493f89-4493f9a call 44a0504 call 44a01a3 602->607 608 4493f7f 602->608 604 4493f42-4493f48 603->604 605->603 606->602 606->605 616 4493fa0-4493fac call 44a01cd 607->616 617 4494185-449418f call 4494c9d 607->617 608->605 610 4493f81-4493f87 608->610 610->605 610->607 616->617 622 4493fb2-4493fbe call 44a01f7 616->622 622->617 625 4493fc4-4493fcb 622->625 626 449403b-4494046 call 44a02d9 625->626 627 4493fcd 625->627 626->604 633 449404c-449404f 626->633 629 4493fcf-4493fd5 627->629 630 4493fd7-4493ff3 call 44a02d9 627->630 629->626 629->630 630->604 637 4493ff9-4493ffc 630->637 635 449407e-449408b 633->635 636 4494051-449405a call 44a0554 633->636 639 449408d-449409c call 44a0f40 635->639 636->635 647 449405c-449407c 636->647 640 449413e-4494140 637->640 641 4494002-449400b call 44a0554 637->641 648 44940a9-44940d0 call 44a0e90 call 44a0f40 639->648 649 449409e-44940a6 639->649 640->604 641->640 650 4494011-4494029 call 44a02d9 641->650 647->639 658 44940de-4494105 call 44a0e90 call 44a0f40 648->658 659 44940d2-44940db 648->659 649->648 650->604 655 449402f-4494036 650->655 655->640 664 4494113-4494122 call 44a0e90 658->664 665 4494107-4494110 658->665 659->658 668 449414f-4494168 664->668 669 4494124 664->669 665->664 672 449413b 668->672 673 449416a-4494183 668->673 670 449412a-4494138 669->670 671 4494126-4494128 669->671 670->672 671->670 674 4494145-4494147 671->674 672->640 673->640 674->640 675 4494149 674->675 675->668 676 449414b-449414d 675->676 676->640 676->668
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 04493F51
                                                                            • Part of subcall function 04495BA8: __getptd_noexit.LIBCMT ref: 04495BA8
                                                                          • __gmtime64_s.LIBCMT ref: 04493FEA
                                                                          • __gmtime64_s.LIBCMT ref: 04494020
                                                                          • __gmtime64_s.LIBCMT ref: 0449403D
                                                                          • __allrem.LIBCMT ref: 04494093
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 044940AF
                                                                          • __allrem.LIBCMT ref: 044940C6
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 044940E4
                                                                          • __allrem.LIBCMT ref: 044940FB
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04494119
                                                                          • __invoke_watson.LIBCMT ref: 0449418A
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                          • String ID:
                                                                          • API String ID: 384356119-0
                                                                          • Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                          • Instruction ID: 48680e7a371160471c132b2e9719c00e3f0e0e10ffb5dd25bda11e76c616944a
                                                                          • Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                          • Instruction Fuzzy Hash: BE71F472A00716ABEF14DE6ACC45B6BBBF8AF15368F14422BE814D6381E770FD019790
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0449650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
                                                                          • String ID:
                                                                          • API String ID: 3432600739-0
                                                                          • Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                          • Instruction ID: 63cc93835fe3f290575e10ea0523193bfaceccfeacb6a807792d151f2766f830
                                                                          • Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                          • Instruction Fuzzy Hash: 8941F332904305AFEF10AFA5D941B9E3FE4AF44328F11442FE91496292DB75BD45FB11
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 044984AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 741 44984ab-44984d9 call 4498477 746 44984db-44984de 741->746 747 44984f3-449850b call 449158d 741->747 748 44984ed 746->748 749 44984e0-44984eb call 449158d 746->749 753 449850d-449850f 747->753 754 4498524-449855a call 449158d * 3 747->754 748->747 749->746 749->748 756 449851e 753->756 757 4498511-449851c call 449158d 753->757 766 449856b-449857e 754->766 767 449855c-4498562 754->767 756->754 757->753 757->756 772 449858d-4498594 766->772 773 4498580-4498587 call 449158d 766->773 767->766 768 4498564-449856a call 449158d 767->768 768->766 775 44985a3-44985ae 772->775 776 4498596-449859d call 449158d 772->776 773->772 779 44985cb-44985cd 775->779 780 44985b0-44985bc 775->780 776->775 780->779 782 44985be-44985c5 call 449158d 780->782 782->779
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free$ExitProcess___crt
                                                                          • String ID:
                                                                          • API String ID: 1022109855-0
                                                                          • Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
                                                                          • Instruction ID: ac8ae0e992187bbcdfe3cfcc57f1942e11748076a9b4dc3a79ff819b40190d4f
                                                                          • Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
                                                                          • Instruction Fuzzy Hash: 2831BF319002519BEFA1AF19FC8084A7FE4EB153343058A6FE904572A0CBB4BDC8BE90
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 044BFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • std::exception::exception.LIBCMT ref: 044BFC1F
                                                                            • Part of subcall function 044A169C: std::exception::_Copy_str.LIBCMT ref: 044A16B5
                                                                          • __CxxThrowException@8.LIBCMT ref: 044BFC34
                                                                          • std::exception::exception.LIBCMT ref: 044BFC4D
                                                                          • __CxxThrowException@8.LIBCMT ref: 044BFC62
                                                                          • std::regex_error::regex_error.LIBCPMT ref: 044BFC74
                                                                            • Part of subcall function 044BF914: std::exception::exception.LIBCMT ref: 044BF92E
                                                                          • __CxxThrowException@8.LIBCMT ref: 044BFC82
                                                                          • std::exception::exception.LIBCMT ref: 044BFC9B
                                                                          • __CxxThrowException@8.LIBCMT ref: 044BFCB0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
                                                                          • String ID: leM
                                                                          • API String ID: 3569886845-2926266777
                                                                          • Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                          • Instruction ID: 530edb6e727ff035325f286eb6dd8dafdfd1db2dead4526b174c1ae1d5e9dab4
                                                                          • Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                          • Instruction Fuzzy Hash: 0F11FE79C0020DBBCF00FFA5D855CDDBB7CAA14344F44896BAD2497241EB74B7588B95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0447F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free_malloc_wprintf$_sprintf
                                                                          • String ID:
                                                                          • API String ID: 3721157643-0
                                                                          • Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
                                                                          • Instruction ID: 4abe43446f318d56fc4aed8bf9b3fa9288b836992d74f38a2a5dc8a2ca36ce24
                                                                          • Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
                                                                          • Instruction Fuzzy Hash: 181105B29005903AEF61B6B60C11EFF3EDC9F45715F0405AFFA48D1281DA587E09A3B1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04481960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_memset$_malloc_sprintf
                                                                          • String ID:
                                                                          • API String ID: 65388428-0
                                                                          • Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
                                                                          • Instruction ID: 241ed28125bd164d20910aa35e34c56d4a6b0db20cd7423f646673d5ec0cd7e4
                                                                          • Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
                                                                          • Instruction Fuzzy Hash: C7513E71D40209ABEF11DBA5DC85FEFBBB8FB04744F14012AF905B6180E7746A058BA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0447F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_memset_sprintf
                                                                          • String ID:
                                                                          • API String ID: 217217746-0
                                                                          • Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                          • Instruction ID: 2c9e7171af5409a1a12b36105b5cdf6b9687ffaec9d8ac5b168c7391d7e59f29
                                                                          • Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                          • Instruction Fuzzy Hash: C3515271D40209AAEF11DFA1DC46FEFBBB8FB04704F14012AF905B6181EB75BA059BA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0447F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Exception@8Throw$_memset_sprintf
                                                                          • String ID:
                                                                          • API String ID: 217217746-0
                                                                          • Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                          • Instruction ID: 46cb9a1e8a369f417ad67c63281b03ccb4e4a2a054ccf786f894e5b3e08c1756
                                                                          • Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                          • Instruction Fuzzy Hash: 67515171D40209ABEF11DFA1DC46FEFBBB8FB04704F14012AF905B6281E67479068BA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 044B208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
                                                                          • String ID:
                                                                          • API String ID: 3534693527-0
                                                                          • Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                          • Instruction ID: c9fd1b39029b74e97e29f8e4754b16942a808641fdab5475e088424b9d03556c
                                                                          • Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                          • Instruction Fuzzy Hash: 19310932A046216AEF216EA5CC087DF3BD4BF05B19F10445BEA44EB381DBB4B80193F1
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 045366D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd_noexit.LIBCMT ref: 045366DD
                                                                            • Part of subcall function 044959BF: __calloc_crt.LIBCMT ref: 044959E2
                                                                            • Part of subcall function 044959BF: __initptd.LIBCMT ref: 04495A04
                                                                          • __calloc_crt.LIBCMT ref: 04536700
                                                                          • __get_sys_err_msg.LIBCMT ref: 0453671E
                                                                          • __invoke_watson.LIBCMT ref: 0453673B
                                                                          • __get_sys_err_msg.LIBCMT ref: 0453676D
                                                                          • __invoke_watson.LIBCMT ref: 0453678B
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
                                                                          • String ID:
                                                                          • API String ID: 4066021419-0
                                                                          • Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                          • Instruction ID: a4d54b56022cfdc6287603c1e69012616071eaece3ddca9462c73091ced990e9
                                                                          • Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                          • Instruction Fuzzy Hash: 5211B2326012147BFF316A66EC40BAA77DCEF416AAF50042FFE0896241E621FD0162E4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04482670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID: D
                                                                          • API String ID: 2102423945-2746444292
                                                                          • Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                          • Instruction ID: 68ad2cc9e8960dd61ca3f06f080eeca849ab499818bc3e7d08a059de49b2f52d
                                                                          • Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                          • Instruction Fuzzy Hash: DDE14D71D00219ABDF24EFA0DD49FEEBBB8BF04704F1441AAE509B6190EB746A85CF54
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0447D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID: $$$(
                                                                          • API String ID: 2102423945-3551151888
                                                                          • Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                          • Instruction ID: a34020c409e630446240ac098fa90eee8f5646d91a81e8b99734dcda243b8b18
                                                                          • Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                          • Instruction Fuzzy Hash: 0191B1B1D00218ABEF20DFA0CC49BEEBBB4BF05304F14456AD405772C1D7B66A49CB65
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04495CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _wcsnlen
                                                                          • String ID: U
                                                                          • API String ID: 3628947076-3372436214
                                                                          • Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                          • Instruction ID: 0dc0aae37b09e88b9d1b1d6fa3367624cb61ab19eae1d901c4f4640341b04194
                                                                          • Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                          • Instruction Fuzzy Hash: 33210833208208BEFF119EA5EC45FBB7BECDB45260F60416BE908C6290FA70FD416694
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 044BFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • std::exception::exception.LIBCMT ref: 044BFBF1
                                                                            • Part of subcall function 044A169C: std::exception::_Copy_str.LIBCMT ref: 044A16B5
                                                                          • __CxxThrowException@8.LIBCMT ref: 044BFC06
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
                                                                          • String ID: TeM$TeM
                                                                          • API String ID: 3662862379-3870166017
                                                                          • Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                          • Instruction ID: 1793f3a39cdf0d1d7850271995e55b5ebf252d535f405f3445f3f5e41e483ca7
                                                                          • Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                          • Instruction Fuzzy Hash: 6CD06775C0020CBBDF00EFA5D459CDDBBB8AA14348F04846BA91497241EA74A7598B95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0447D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0449197D: __wfsopen.LIBCMT ref: 04491988
                                                                          • _fgetws.LIBCMT ref: 0447D15C
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __wfsopen_fgetws
                                                                          • String ID:
                                                                          • API String ID: 853134316-0
                                                                          • Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                          • Instruction ID: eade17c50e69d13451dd220c716798f6bd2bfc648ab57955e5acc86aba2c4442
                                                                          • Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                          • Instruction Fuzzy Hash: C491A1B1D10219ABEF20DFA4CD44BEEB7F5BF04314F14052AE915A3241E779BA06CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0447D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _malloc$__except_handler4_fprintf
                                                                          • String ID:
                                                                          • API String ID: 1783060780-0
                                                                          • Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
                                                                          • Instruction ID: 36fe36243e1dc905f09b33599ce38ea5a8cfc3051adedeaabf6abb9984cd09c9
                                                                          • Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
                                                                          • Instruction Fuzzy Hash: C2A180B0C00248EBFF11EF95C849BDEBFB5AF10308F14046ED40576292D7B66A49DBA6
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 04492AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset$__filbuf__getptd_noexit__read_nolock
                                                                          • String ID:
                                                                          • API String ID: 2974526305-0
                                                                          • Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
                                                                          • Instruction ID: 061cc0bd84ee789d0b54bcfa46b9e5e9c817fa737714c224b3d16de8dfaf82b0
                                                                          • Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
                                                                          • Instruction Fuzzy Hash: 0F519274A00206ABDF258E69888456F7FE5BF40324F148BAFE835963D0D7B0BD51AB40
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 044B1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000A.00000002.419357601.0000000004470000.00000040.00001000.00020000.00000000.sdmp, Offset: 04470000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_10_2_4470000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                          • String ID:
                                                                          • API String ID: 3016257755-0
                                                                          • Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                          • Instruction ID: f5ed86ec4062887f292bf1be329e0a5e1e9fe9b7e49d1d5c065278510f58887b
                                                                          • Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                          • Instruction Fuzzy Hash: E901833200024EFBDF125F85DC11CEE3F62BB18384F089416FA9898530E732E5B2AB91
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Execution Graph

                                                                          Execution Coverage:2.2%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:37.6%
                                                                          Total number of Nodes:812
                                                                          Total number of Limit Nodes:94
                                                                          execution_graph 40290 423f84 40291 423f90 __freefls@4 40290->40291 40327 432603 GetStartupInfoW 40291->40327 40294 423f95 40329 4278d5 GetProcessHeap 40294->40329 40295 423fed 40296 423ff8 40295->40296 40659 42411a 58 API calls 3 library calls 40295->40659 40330 425141 40296->40330 40299 423ffe 40300 424009 __RTC_Initialize 40299->40300 40660 42411a 58 API calls 3 library calls 40299->40660 40351 428754 40300->40351 40303 424018 40304 424024 GetCommandLineW 40303->40304 40661 42411a 58 API calls 3 library calls 40303->40661 40370 43235f GetEnvironmentStringsW 40304->40370 40308 424023 40308->40304 40310 42403e 40311 424049 40310->40311 40662 427c2e 58 API calls 3 library calls 40310->40662 40380 4321a1 40311->40380 40315 42405a 40394 427c68 40315->40394 40318 424062 40319 42406d __wwincmdln 40318->40319 40664 427c2e 58 API calls 3 library calls 40318->40664 40400 419f90 40319->40400 40322 424081 40323 424090 40322->40323 40656 427f3d 40322->40656 40665 427c59 58 API calls _doexit 40323->40665 40326 424095 __freefls@4 40328 432619 40327->40328 40328->40294 40329->40295 40666 427d6c RtlEncodePointer 40330->40666 40332 425146 40672 428c48 InitializeCriticalSectionAndSpinCount __mtinitlocks 40332->40672 40334 42514b 40335 42514f 40334->40335 40674 4324f7 TlsAlloc 40334->40674 40673 4251b7 61 API calls 2 library calls 40335->40673 40338 425154 40338->40299 40339 425161 40339->40335 40340 42516c 40339->40340 40675 428c96 40340->40675 40342 425179 40343 4251ae 40342->40343 40681 432553 TlsSetValue 40342->40681 40683 4251b7 61 API calls 2 library calls 40343->40683 40346 42518d 40346->40343 40348 425193 40346->40348 40347 4251b3 40347->40299 40682 42508e 58 API calls 4 library calls 40348->40682 40350 42519b GetCurrentThreadId 40350->40299 40352 428760 __freefls@4 40351->40352 40697 428af7 40352->40697 40354 428767 40355 428c96 __calloc_crt 58 API calls 40354->40355 40356 428778 40355->40356 40357 4287e3 GetStartupInfoW 40356->40357 40358 428783 @_EH4_CallFilterFunc@8 __freefls@4 40356->40358 40359 428927 40357->40359 40363 4287f8 40357->40363 40358->40303 40360 4289ef 40359->40360 40365 428974 GetStdHandle 40359->40365 40366 428987 GetFileType 40359->40366 40705 43263e InitializeCriticalSectionAndSpinCount 40359->40705 40706 4289ff LeaveCriticalSection _doexit 40360->40706 40362 428846 40362->40359 40367 42887a GetFileType 40362->40367 40704 43263e InitializeCriticalSectionAndSpinCount 40362->40704 40363->40359 40363->40362 40364 428c96 __calloc_crt 58 API calls 40363->40364 40364->40363 40365->40359 40366->40359 40367->40362 40371 432370 40370->40371 40372 424034 40370->40372 40709 428cde 40371->40709 40376 431f64 GetModuleFileNameW 40372->40376 40374 432396 ___check_float_string 40375 4323ac FreeEnvironmentStringsW 40374->40375 40375->40372 40377 431f98 _wparse_cmdline 40376->40377 40378 428cde __malloc_crt 58 API calls 40377->40378 40379 431fd8 _wparse_cmdline 40377->40379 40378->40379 40379->40310 40381 42404f 40380->40381 40382 4321ba _TestDefaultLanguage 40380->40382 40381->40315 40663 427c2e 58 API calls 3 library calls 40381->40663 40383 428c96 __calloc_crt 58 API calls 40382->40383 40387 4321e3 _TestDefaultLanguage 40383->40387 40384 43223a 40748 420bed 58 API calls 2 library calls 40384->40748 40386 428c96 __calloc_crt 58 API calls 40386->40387 40387->40381 40387->40384 40387->40386 40388 43225f 40387->40388 40391 432276 40387->40391 40747 42962f 58 API calls __cftoe_l 40387->40747 40749 420bed 58 API calls 2 library calls 40388->40749 40750 4242fd 8 API calls 2 library calls 40391->40750 40393 432282 40396 427c74 __IsNonwritableInCurrentImage 40394->40396 40751 43aeb5 40396->40751 40397 427c92 __initterm_e 40399 427cb1 _doexit __IsNonwritableInCurrentImage 40397->40399 40754 4219ac 67 API calls __cinit 40397->40754 40399->40318 40401 419fa0 __write_nolock 40400->40401 40755 40cf10 40401->40755 40403 419fb0 40404 419fc4 GetCurrentProcess GetLastError SetPriorityClass 40403->40404 40405 419fb4 40403->40405 40407 419fe4 GetLastError 40404->40407 40408 419fe6 40404->40408 40979 4124e0 109 API calls _memset 40405->40979 40407->40408 40769 41d3c0 40408->40769 40409 419fb9 40409->40322 40412 41a022 40772 41d340 40412->40772 40413 41b669 41060 44f23e 59 API calls 2 library calls 40413->41060 40415 41b673 41061 44f23e 59 API calls 2 library calls 40415->41061 40420 41a065 40777 413a90 40420->40777 40424 41a159 GetCommandLineW CommandLineToArgvW lstrcpyW 40426 41a33d GlobalFree 40424->40426 40440 41a196 40424->40440 40425 41a100 40425->40424 40427 41a354 40426->40427 40428 41a45c 40426->40428 40430 412220 76 API calls 40427->40430 40833 412220 40428->40833 40431 41a359 40430->40431 40433 41a466 40431->40433 40848 40ef50 40431->40848 40432 41a1cc lstrcmpW lstrcmpW 40432->40440 40433->40322 40435 41a24a lstrcpyW lstrcpyW lstrcmpW lstrcmpW 40435->40440 40436 420235 60 API calls ___get_qualified_locale 40436->40440 40437 41a48f 40439 41a4ef 40437->40439 40853 413ea0 40437->40853 40441 411cd0 92 API calls 40439->40441 40440->40426 40440->40432 40440->40435 40440->40436 40442 41a361 40440->40442 40444 41a563 40441->40444 40793 423c92 40442->40793 40476 41a5db 40444->40476 40874 414690 40444->40874 40446 41a395 OpenProcess 40447 41a402 40446->40447 40448 41a3a9 WaitForSingleObject CloseHandle 40446->40448 40796 411cd0 40447->40796 40448->40447 40452 41a3cb 40448->40452 40449 41a6f9 40981 411a10 8 API calls 40449->40981 40467 41a3e2 GlobalFree 40452->40467 40468 41a3d4 Sleep 40452->40468 40980 411ab0 PeekMessageW DispatchMessageW PeekMessageW 40452->40980 40453 41a6fe 40456 41a8b6 CreateMutexA 40453->40456 40457 41a70f 40453->40457 40454 41a5a9 40459 414690 59 API calls 40454->40459 40463 41a8ca 40456->40463 40462 41a7dc 40457->40462 40472 40ef50 58 API calls 40457->40472 40465 41a5d4 40459->40465 40460 41a40b GetCurrentProcess GetExitCodeProcess TerminateProcess CloseHandle 40461 41a451 40460->40461 40461->40322 40469 40ef50 58 API calls 40462->40469 40466 40ef50 58 API calls 40463->40466 40464 41a624 GetVersion 40464->40449 40470 41a632 lstrcpyW lstrcatW lstrcatW 40464->40470 40897 40d240 CoInitialize 40465->40897 40480 41a8da 40466->40480 40473 41a3f7 40467->40473 40468->40446 40474 41a7ec 40469->40474 40475 41a674 _memset 40470->40475 40483 41a72f 40472->40483 40473->40322 40477 41a7f1 lstrlenA 40474->40477 40479 41a6b4 ShellExecuteExW 40475->40479 40476->40449 40476->40453 40476->40456 40476->40464 40478 420c62 _malloc 58 API calls 40477->40478 40481 41a810 _memset 40478->40481 40479->40453 40500 41a6e3 40479->40500 40482 413ea0 59 API calls 40480->40482 40496 41a92f 40480->40496 40485 41a81e MultiByteToWideChar lstrcatW 40481->40485 40482->40480 40484 413ea0 59 API calls 40483->40484 40487 41a780 40483->40487 40484->40483 40485->40477 40486 41a847 lstrlenW 40485->40486 40488 41a8a0 CreateMutexA 40486->40488 40489 41a856 40486->40489 40490 41a792 40487->40490 40491 41a79c CreateThread 40487->40491 40488->40463 40983 40e760 95 API calls 40489->40983 40982 413ff0 59 API calls ___check_float_string 40490->40982 40491->40462 40495 41a7d0 40491->40495 40494 41a860 CreateThread WaitForSingleObject 40494->40488 40495->40462 40984 415c10 40496->40984 40498 41a98c 40999 412840 60 API calls 40498->40999 40500->40322 40501 41a997 41000 410fc0 93 API calls 4 library calls 40501->41000 40503 41a9ab 40504 41a9c2 lstrlenA 40503->40504 40504->40500 40505 41a9d8 40504->40505 40506 415c10 59 API calls 40505->40506 40507 41aa23 40506->40507 41001 412840 60 API calls 40507->41001 40509 41aa2e lstrcpyA 40511 41aa4b 40509->40511 40512 415c10 59 API calls 40511->40512 40513 41aa90 40512->40513 40514 40ef50 58 API calls 40513->40514 40515 41aaa0 40514->40515 40516 413ea0 59 API calls 40515->40516 40517 41aaf5 40515->40517 40516->40515 41002 413ff0 59 API calls ___check_float_string 40517->41002 40519 41ab1d 41003 412900 40519->41003 40521 41ab28 _memmove 40522 40ef50 58 API calls 40521->40522 40523 41abc5 40522->40523 40523->40523 40524 413ea0 59 API calls 40523->40524 40525 41ac1e 40523->40525 40524->40523 41008 413ff0 59 API calls ___check_float_string 40525->41008 40527 41ac46 40528 412900 60 API calls 40527->40528 40530 41ac51 _memmove 40528->40530 40529 40ef50 58 API calls 40531 41acee 40529->40531 40530->40529 40532 413ea0 59 API calls 40531->40532 40533 41ad43 40531->40533 40532->40531 41009 413ff0 59 API calls ___check_float_string 40533->41009 40535 41ad6b 40536 412900 60 API calls 40535->40536 40539 41ad76 _memmove 40536->40539 40537 415c10 59 API calls 40538 41ae2a 40537->40538 41010 413580 59 API calls 40538->41010 40539->40537 40541 41ae3c 40542 415c10 59 API calls 40541->40542 40543 41ae76 40542->40543 41011 413580 59 API calls 40543->41011 40545 41ae82 40546 415c10 59 API calls 40545->40546 40547 41aebc 40546->40547 41012 413580 59 API calls 40547->41012 40549 41aec8 40550 415c10 59 API calls 40549->40550 40551 41af02 40550->40551 41013 413580 59 API calls 40551->41013 40553 41af0e 40554 415c10 59 API calls 40553->40554 40555 41af48 40554->40555 41014 413580 59 API calls 40555->41014 40557 41af54 40558 415c10 59 API calls 40557->40558 40559 41af8e 40558->40559 41015 413580 59 API calls 40559->41015 40561 41af9a 40562 415c10 59 API calls 40561->40562 40563 41afd4 40562->40563 41016 413580 59 API calls 40563->41016 40565 41afe0 41017 413100 59 API calls 40565->41017 40567 41b001 41018 413580 59 API calls 40567->41018 40569 41b025 41019 413100 59 API calls 40569->41019 40571 41b03c 41020 413580 59 API calls 40571->41020 40573 41b059 41021 413100 59 API calls 40573->41021 40575 41b070 41022 413580 59 API calls 40575->41022 40577 41b07c 41023 413100 59 API calls 40577->41023 40579 41b093 41024 413580 59 API calls 40579->41024 40581 41b09f 41025 413100 59 API calls 40581->41025 40583 41b0b6 41026 413580 59 API calls 40583->41026 40585 41b0c2 41027 413100 59 API calls 40585->41027 40587 41b0d9 41028 413580 59 API calls 40587->41028 40589 41b0e5 41029 413100 59 API calls 40589->41029 40591 41b0fc 41030 413580 59 API calls 40591->41030 40593 41b108 40595 41b130 40593->40595 41031 41cdd0 59 API calls 40593->41031 40596 40ef50 58 API calls 40595->40596 40597 41b16e 40596->40597 40599 41b1a5 GetUserNameW 40597->40599 41032 412de0 59 API calls 40597->41032 40600 41b1c9 40599->40600 41033 412c40 40600->41033 40602 41b1d8 41040 412bf0 59 API calls 40602->41040 40604 41b1ea 41041 40ecb0 60 API calls 2 library calls 40604->41041 40606 41b2f5 41044 4136c0 59 API calls 40606->41044 40608 41b308 41045 40ca70 59 API calls 40608->41045 40610 41b311 41046 4130b0 59 API calls 40610->41046 40612 412c40 59 API calls 40627 41b1f3 40612->40627 40613 41b322 41047 40c740 118 API calls 4 library calls 40613->41047 40615 412900 60 API calls 40615->40627 40616 41b327 41048 4111c0 169 API calls 2 library calls 40616->41048 40619 41b33b 41049 41ba10 LoadCursorW RegisterClassExW 40619->41049 40621 41b343 41050 41ba80 CreateWindowExW ShowWindow UpdateWindow 40621->41050 40623 413100 59 API calls 40623->40627 40624 41b34b 40628 41b34f 40624->40628 41051 410a50 65 API calls 40624->41051 40627->40606 40627->40612 40627->40615 40627->40623 41042 413580 59 API calls 40627->41042 41043 40f1f0 59 API calls 40627->41043 40628->40500 40629 41b379 41052 413100 59 API calls 40629->41052 40631 41b3a5 41053 413580 59 API calls 40631->41053 40633 41b48b 41059 41fdc0 CreateThread 40633->41059 40635 41b49f GetMessageW 40636 41b4ed 40635->40636 40637 41b4bf 40635->40637 40641 41b502 PostThreadMessageW 40636->40641 40642 41b55b 40636->40642 40639 41b4c5 TranslateMessage DispatchMessageW GetMessageW 40637->40639 40638 41b3b3 40638->40633 41054 41c330 59 API calls 40638->41054 41055 41c240 59 API calls 40638->41055 41056 41b8b0 59 API calls 40638->41056 41057 413260 59 API calls 40638->41057 41058 41fa10 CreateThread 40638->41058 40639->40636 40639->40639 40643 41b510 PeekMessageW 40641->40643 40644 41b564 PostThreadMessageW 40642->40644 40645 41b5bb 40642->40645 40646 41b546 WaitForSingleObject 40643->40646 40647 41b526 DispatchMessageW PeekMessageW 40643->40647 40648 41b570 PeekMessageW 40644->40648 40645->40628 40649 41b5d2 CloseHandle 40645->40649 40646->40642 40646->40643 40647->40646 40647->40647 40650 41b5a6 WaitForSingleObject 40648->40650 40651 41b586 DispatchMessageW PeekMessageW 40648->40651 40649->40628 40650->40645 40650->40648 40651->40650 40651->40651 41345 427e0e 40656->41345 40658 427f4c 40658->40323 40659->40296 40660->40300 40661->40308 40665->40326 40684 427963 40666->40684 40668 427d7d __init_pointers __initp_misc_winsig 40685 423540 EncodePointer 40668->40685 40670 427d95 __init_pointers 40671 4326ac 34 API calls 40670->40671 40671->40332 40672->40334 40673->40338 40674->40339 40677 428c9d 40675->40677 40678 428cd8 40677->40678 40680 428cbb 40677->40680 40686 43b813 40677->40686 40678->40342 40680->40677 40680->40678 40694 4329c9 Sleep 40680->40694 40681->40346 40682->40350 40683->40347 40684->40668 40685->40670 40687 43b81e 40686->40687 40692 43b839 40686->40692 40688 43b82a 40687->40688 40687->40692 40695 425208 58 API calls __getptd_noexit 40688->40695 40690 43b849 HeapAlloc 40690->40692 40693 43b82f 40690->40693 40692->40690 40692->40693 40696 42793d DecodePointer 40692->40696 40693->40677 40694->40680 40695->40693 40696->40692 40698 428b1b EnterCriticalSection 40697->40698 40699 428b08 40697->40699 40698->40354 40707 428b9f 58 API calls 10 library calls 40699->40707 40701 428b0e 40701->40698 40708 427c2e 58 API calls 3 library calls 40701->40708 40704->40362 40705->40359 40706->40358 40707->40701 40710 428cec 40709->40710 40712 428d1e 40710->40712 40714 428cff 40710->40714 40715 420c62 40710->40715 40712->40374 40714->40710 40714->40712 40732 4329c9 Sleep 40714->40732 40716 420cdd 40715->40716 40722 420c6e 40715->40722 40741 42793d DecodePointer 40716->40741 40718 420ce3 40742 425208 58 API calls __getptd_noexit 40718->40742 40719 420c79 40719->40722 40733 427f51 58 API calls 2 library calls 40719->40733 40734 427fae 58 API calls 7 library calls 40719->40734 40735 427b0b 40719->40735 40722->40719 40723 420ca1 RtlAllocateHeap 40722->40723 40726 420cc9 40722->40726 40730 420cc7 40722->40730 40738 42793d DecodePointer 40722->40738 40723->40722 40724 420cd5 40723->40724 40724->40710 40739 425208 58 API calls __getptd_noexit 40726->40739 40740 425208 58 API calls __getptd_noexit 40730->40740 40732->40714 40733->40719 40734->40719 40743 427ad7 GetModuleHandleExW 40735->40743 40738->40722 40739->40730 40740->40724 40741->40718 40742->40724 40744 427af0 GetProcAddress 40743->40744 40745 427b07 ExitProcess 40743->40745 40744->40745 40746 427b02 40744->40746 40746->40745 40747->40387 40748->40381 40749->40381 40750->40393 40752 43aeb8 EncodePointer 40751->40752 40752->40752 40753 43aed2 40752->40753 40753->40397 40754->40399 40756 40cf32 _memset __write_nolock 40755->40756 40757 40cf4f InternetOpenW 40756->40757 40758 415c10 59 API calls 40757->40758 40759 40cf8a InternetOpenUrlW 40758->40759 40760 40cfb9 InternetReadFile InternetCloseHandle InternetCloseHandle 40759->40760 40768 40cfb2 40759->40768 41062 4156d0 40760->41062 40762 40d000 40763 4156d0 59 API calls 40762->40763 40764 40d049 40763->40764 40764->40768 41081 413010 59 API calls 40764->41081 40766 40d084 40766->40768 41082 413010 59 API calls 40766->41082 40768->40403 41087 41ccc0 40769->41087 41107 41cc50 40772->41107 40775 41a04d 40775->40415 40775->40420 40778 413ab2 40777->40778 40779 413ad0 GetModuleFileNameW PathRemoveFileSpecW 40777->40779 40780 413b00 40778->40780 40781 413aba 40778->40781 40787 418400 40779->40787 41115 44f23e 59 API calls 2 library calls 40780->41115 40782 423b4c 59 API calls 40781->40782 40784 413ac7 40782->40784 40784->40779 41116 44f1bb 59 API calls 3 library calls 40784->41116 40788 418437 40787->40788 40792 418446 40787->40792 40788->40792 41117 415d50 59 API calls ___check_float_string 40788->41117 40789 4184b9 40789->40425 40792->40789 41118 418d50 59 API calls 40792->41118 41119 431781 40793->41119 41137 42f7c0 40796->41137 40799 411d20 _memset 40800 411d40 RegQueryValueExW RegCloseKey 40799->40800 40801 411d8f 40800->40801 40802 415c10 59 API calls 40801->40802 40803 411dbf 40802->40803 40804 411dd1 lstrlenA 40803->40804 40805 411e7c 40803->40805 41139 413520 59 API calls 40804->41139 40807 411e94 6 API calls 40805->40807 40809 411ef5 UuidCreate UuidToStringW 40807->40809 40808 411df1 40810 411e3c PathFileExistsW 40808->40810 40813 411e00 40808->40813 40811 411f36 40809->40811 40810->40805 40812 411e52 40810->40812 40811->40811 40815 415c10 59 API calls 40811->40815 40814 411e6a 40812->40814 40817 414690 59 API calls 40812->40817 40813->40808 40813->40810 40818 4121d1 40814->40818 40816 411f59 RpcStringFreeW PathAppendW CreateDirectoryW 40815->40816 40819 411f98 40816->40819 40821 411fce 40816->40821 40817->40814 40818->40460 40820 415c10 59 API calls 40819->40820 40820->40821 40822 415c10 59 API calls 40821->40822 40823 41201f PathAppendW DeleteFileW CopyFileW RegOpenKeyExW 40822->40823 40823->40818 40824 41207c _memset 40823->40824 40825 412095 6 API calls 40824->40825 40826 412115 _memset 40825->40826 40827 412109 40825->40827 40829 412125 SetLastError lstrcpyW lstrcatW lstrcatW CreateProcessW 40826->40829 41140 413260 59 API calls 40827->41140 40830 4121b2 40829->40830 40831 4121aa GetLastError 40829->40831 40832 4121c0 WaitForSingleObject 40830->40832 40831->40818 40832->40818 40832->40832 40834 42f7c0 __write_nolock 40833->40834 40835 41222d 7 API calls 40834->40835 40836 4122bd K32EnumProcesses 40835->40836 40837 41228c LoadLibraryW GetProcAddress GetProcAddress GetProcAddress 40835->40837 40838 4122d3 40836->40838 40840 4122df 40836->40840 40837->40836 40838->40431 40839 412353 40839->40431 40840->40839 40841 4122f0 OpenProcess 40840->40841 40842 412346 CloseHandle 40841->40842 40843 41230a K32EnumProcessModules 40841->40843 40842->40839 40842->40841 40843->40842 40844 41231c K32GetModuleBaseNameW 40843->40844 41141 420235 40844->41141 40846 41233e 40846->40842 40847 412345 40846->40847 40847->40842 40849 420c62 _malloc 58 API calls 40848->40849 40852 40ef6e _memset 40849->40852 40850 40efdc 40850->40437 40851 420c62 _malloc 58 API calls 40851->40852 40852->40850 40852->40851 40852->40852 40854 413f05 40853->40854 40858 413eae 40853->40858 40855 413fb1 40854->40855 40856 413f18 40854->40856 41157 44f23e 59 API calls 2 library calls 40855->41157 40859 413fbb 40856->40859 40860 413f2d 40856->40860 40861 413f3d ___check_float_string 40856->40861 40858->40854 40865 413ed4 40858->40865 41158 44f23e 59 API calls 2 library calls 40859->41158 40860->40861 41156 416760 59 API calls 2 library calls 40860->41156 40861->40437 40867 413ed9 40865->40867 40868 413eef 40865->40868 41154 413da0 59 API calls ___check_float_string 40867->41154 41155 413da0 59 API calls ___check_float_string 40868->41155 40872 413ee9 40872->40437 40873 413eff 40873->40437 40875 4146a9 40874->40875 40876 41478c 40874->40876 40878 4146b6 40875->40878 40879 4146e9 40875->40879 41161 44f26c 59 API calls 3 library calls 40876->41161 40880 414796 40878->40880 40881 4146c2 40878->40881 40882 4147a0 40879->40882 40883 4146f5 40879->40883 41162 44f26c 59 API calls 3 library calls 40880->41162 41159 413340 59 API calls _memmove 40881->41159 41163 44f23e 59 API calls 2 library calls 40882->41163 40893 414707 ___check_float_string 40883->40893 41160 416950 59 API calls 2 library calls 40883->41160 40892 4146e0 40892->40454 40893->40454 40898 40d27d CoInitializeSecurity 40897->40898 40904 40d276 40897->40904 40899 414690 59 API calls 40898->40899 40900 40d2b8 CoCreateInstance 40899->40900 40901 40d2e3 VariantInit VariantInit VariantInit VariantInit 40900->40901 40902 40da3c CoUninitialize 40900->40902 40903 40d38e VariantClear VariantClear VariantClear VariantClear 40901->40903 40902->40904 40905 40d3e2 40903->40905 40906 40d3cc CoUninitialize 40903->40906 40904->40476 41164 40b140 40905->41164 40906->40904 40909 40d3f6 41169 40b1d0 40909->41169 40911 40d422 40912 40d426 CoUninitialize 40911->40912 40913 40d43c 40911->40913 40912->40904 40914 40b140 60 API calls 40913->40914 40916 40d449 40914->40916 40917 40b1d0 SysFreeString 40916->40917 40918 40d471 40917->40918 40919 40d496 CoUninitialize 40918->40919 40920 40d4ac 40918->40920 40919->40904 40922 40b140 60 API calls 40920->40922 40977 40d8cf 40920->40977 40923 40d4d5 40922->40923 40924 40b1d0 SysFreeString 40923->40924 40925 40d4fd 40924->40925 40926 40b140 60 API calls 40925->40926 40925->40977 40927 40d5ae 40926->40927 40928 40b1d0 SysFreeString 40927->40928 40929 40d5d6 40928->40929 40930 40b140 60 API calls 40929->40930 40929->40977 40931 40d679 40930->40931 40932 40b1d0 SysFreeString 40931->40932 40933 40d6a1 40932->40933 40934 40b140 60 API calls 40933->40934 40933->40977 40935 40d6b6 40934->40935 40936 40b1d0 SysFreeString 40935->40936 40937 40d6de 40936->40937 40938 40b140 60 API calls 40937->40938 40937->40977 40939 40d707 40938->40939 40940 40b1d0 SysFreeString 40939->40940 40941 40d72f 40940->40941 40942 40b140 60 API calls 40941->40942 40941->40977 40943 40d744 40942->40943 40944 40b1d0 SysFreeString 40943->40944 40945 40d76c 40944->40945 40945->40977 41173 423aaf GetSystemTimeAsFileTime 40945->41173 40947 40d77d 41175 423551 40947->41175 40952 412c40 59 API calls 40953 40d7b5 40952->40953 40954 412900 60 API calls 40953->40954 40955 40d7c3 40954->40955 40956 40b140 60 API calls 40955->40956 40957 40d7db 40956->40957 40958 40b1d0 SysFreeString 40957->40958 40959 40d7ff 40958->40959 40960 40b140 60 API calls 40959->40960 40959->40977 40961 40d8a3 40960->40961 40962 40b1d0 SysFreeString 40961->40962 40963 40d8cb 40962->40963 40964 40b140 60 API calls 40963->40964 40963->40977 40965 40d8ea 40964->40965 40966 40b1d0 SysFreeString 40965->40966 40967 40d912 40966->40967 40967->40977 41183 40b400 SysAllocString 40967->41183 40969 40d936 VariantInit VariantInit 40970 40b140 60 API calls 40969->40970 40971 40d985 40970->40971 40972 40b1d0 SysFreeString 40971->40972 40973 40d9e7 VariantClear VariantClear VariantClear 40972->40973 40974 40da10 40973->40974 40975 40da46 CoUninitialize 40973->40975 41187 42052a 78 API calls __snprintf_l 40974->41187 40975->40904 40977->40902 40979->40409 40980->40452 40981->40453 40982->40491 40983->40494 40985 415c66 40984->40985 40990 415c1e 40984->40990 40986 415c76 40985->40986 40987 415cff 40985->40987 40996 415c88 ___check_float_string 40986->40996 41343 416950 59 API calls 2 library calls 40986->41343 41344 44f23e 59 API calls 2 library calls 40987->41344 40990->40985 40994 415c45 40990->40994 40997 414690 59 API calls 40994->40997 40996->40498 40998 415c60 40997->40998 40998->40498 40999->40501 41000->40503 41001->40509 41002->40519 41004 413a90 59 API calls 41003->41004 41005 41294c MultiByteToWideChar 41004->41005 41006 418400 59 API calls 41005->41006 41007 41298d 41006->41007 41007->40521 41008->40527 41009->40535 41010->40541 41011->40545 41012->40549 41013->40553 41014->40557 41015->40561 41016->40565 41017->40567 41018->40569 41019->40571 41020->40573 41021->40575 41022->40577 41023->40579 41024->40581 41025->40583 41026->40585 41027->40587 41028->40589 41029->40591 41030->40593 41031->40595 41032->40597 41034 412c71 41033->41034 41035 412c5f 41033->41035 41038 4156d0 59 API calls 41034->41038 41036 4156d0 59 API calls 41035->41036 41037 412c6a 41036->41037 41037->40602 41039 412c8a 41038->41039 41039->40602 41040->40604 41041->40627 41042->40627 41043->40627 41044->40608 41045->40610 41046->40613 41047->40616 41048->40619 41049->40621 41050->40624 41051->40629 41052->40631 41053->40638 41054->40638 41055->40638 41056->40638 41057->40638 41058->40638 41059->40635 41063 415735 41062->41063 41067 4156de 41062->41067 41064 4157bc 41063->41064 41065 41573e 41063->41065 41086 44f23e 59 API calls 2 library calls 41064->41086 41071 415750 ___check_float_string 41065->41071 41085 416760 59 API calls 2 library calls 41065->41085 41067->41063 41073 415704 41067->41073 41071->40762 41075 415709 41073->41075 41076 41571f 41073->41076 41083 413ff0 59 API calls ___check_float_string 41075->41083 41084 413ff0 59 API calls ___check_float_string 41076->41084 41079 415719 41079->40762 41080 41572f 41080->40762 41081->40766 41082->40768 41083->41079 41084->41080 41085->41071 41093 423b4c 41087->41093 41089 41ccca 41090 41a00a 41089->41090 41103 44f1bb 59 API calls 3 library calls 41089->41103 41090->40412 41090->40413 41095 423b54 41093->41095 41094 420c62 _malloc 58 API calls 41094->41095 41095->41094 41096 423b6e 41095->41096 41098 423b72 std::exception::exception 41095->41098 41104 42793d DecodePointer 41095->41104 41096->41089 41105 430eca RaiseException 41098->41105 41100 423b9c 41106 430d91 58 API calls _free 41100->41106 41102 423bae 41102->41089 41104->41095 41105->41100 41106->41102 41108 423b4c 59 API calls 41107->41108 41109 41cc5d 41108->41109 41111 41cc64 41109->41111 41114 44f1bb 59 API calls 3 library calls 41109->41114 41111->40775 41113 41d740 59 API calls 41111->41113 41113->40775 41117->40792 41118->40792 41122 431570 41119->41122 41123 431580 41122->41123 41124 431586 41123->41124 41129 4315ae 41123->41129 41133 425208 58 API calls __getptd_noexit 41124->41133 41126 43158b 41134 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 41126->41134 41131 4315cf wcstoxq 41129->41131 41135 42e883 GetStringTypeW 41129->41135 41130 41a36e lstrcpyW lstrcpyW 41130->40446 41131->41130 41136 425208 58 API calls __getptd_noexit 41131->41136 41133->41126 41134->41130 41135->41129 41136->41130 41138 411cf2 RegOpenKeyExW 41137->41138 41138->40799 41138->40818 41139->40808 41140->40826 41142 420241 41141->41142 41143 4202b6 41141->41143 41150 420266 41142->41150 41151 425208 58 API calls __getptd_noexit 41142->41151 41153 4202c8 60 API calls 3 library calls 41143->41153 41146 4202c3 41146->40846 41147 42024d 41152 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 41147->41152 41149 420258 41149->40846 41150->40846 41151->41147 41152->41149 41153->41146 41154->40872 41155->40873 41156->40861 41159->40892 41160->40893 41161->40880 41162->40882 41165 423b4c 59 API calls 41164->41165 41166 40b164 41165->41166 41167 40b177 SysAllocString 41166->41167 41168 40b194 41166->41168 41167->41168 41168->40909 41170 40b202 41169->41170 41171 40b1de 41169->41171 41170->40911 41171->41170 41172 40b1f5 SysFreeString 41171->41172 41172->41170 41174 423add __aulldiv 41173->41174 41174->40947 41188 43035d 41175->41188 41177 42355a 41178 40d78f 41177->41178 41196 423576 41177->41196 41180 4228e0 41178->41180 41298 42279f 41180->41298 41184 40b423 41183->41184 41185 40b41d 41183->41185 41186 40b42d VariantClear 41184->41186 41185->40969 41186->40969 41187->40977 41229 42501f 58 API calls 4 library calls 41188->41229 41190 430363 41192 43038d 41190->41192 41193 428cde __malloc_crt 58 API calls 41190->41193 41195 430369 41190->41195 41192->41177 41193->41195 41194 43036e 41194->41177 41195->41192 41230 425208 58 API calls __getptd_noexit 41195->41230 41197 423591 41196->41197 41198 4235a9 _memset 41196->41198 41239 425208 58 API calls __getptd_noexit 41197->41239 41198->41197 41205 4235c0 41198->41205 41200 423596 41240 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 41200->41240 41202 4235cb 41241 425208 58 API calls __getptd_noexit 41202->41241 41203 4235e9 41231 42fb64 41203->41231 41205->41202 41205->41203 41207 4235ee 41242 42f803 58 API calls __cftoe_l 41207->41242 41209 4235f7 41210 4237e5 41209->41210 41243 42f82d 58 API calls __cftoe_l 41209->41243 41256 4242fd 8 API calls 2 library calls 41210->41256 41213 4237ef 41214 423609 41214->41210 41244 42f857 41214->41244 41216 42361b 41216->41210 41217 423624 41216->41217 41218 42369b 41217->41218 41220 423637 41217->41220 41254 42f939 58 API calls 4 library calls 41218->41254 41251 42f939 58 API calls 4 library calls 41220->41251 41221 4236a2 41228 4235a0 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 41221->41228 41255 42fbb4 58 API calls 4 library calls 41221->41255 41223 42364f 41223->41228 41252 42fbb4 58 API calls 4 library calls 41223->41252 41226 423668 41226->41228 41253 42f939 58 API calls 4 library calls 41226->41253 41228->41178 41229->41190 41230->41194 41233 42fb70 __freefls@4 41231->41233 41232 42fba5 __freefls@4 41232->41207 41233->41232 41234 428af7 __lock 58 API calls 41233->41234 41235 42fb80 41234->41235 41236 42fb93 41235->41236 41257 42fe47 41235->41257 41286 42fbab LeaveCriticalSection _doexit 41236->41286 41239->41200 41240->41228 41241->41228 41242->41209 41243->41214 41245 42f861 41244->41245 41246 42f876 41244->41246 41296 425208 58 API calls __getptd_noexit 41245->41296 41246->41216 41248 42f866 41297 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 41248->41297 41250 42f871 41250->41216 41251->41223 41252->41226 41253->41228 41254->41221 41255->41228 41256->41213 41258 42fe53 __freefls@4 41257->41258 41259 428af7 __lock 58 API calls 41258->41259 41260 42fe71 _W_expandtime 41259->41260 41261 42f857 __tzset_nolock 58 API calls 41260->41261 41262 42fe86 41261->41262 41277 42ff25 __tzset_nolock 41262->41277 41287 42f803 58 API calls __cftoe_l 41262->41287 41265 42fe98 41265->41277 41288 42f82d 58 API calls __cftoe_l 41265->41288 41266 42ff71 GetTimeZoneInformation 41266->41277 41269 42feaa 41269->41277 41289 433f99 58 API calls 2 library calls 41269->41289 41270 42ffd8 WideCharToMultiByte 41270->41277 41272 42feb8 41290 441667 78 API calls 3 library calls 41272->41290 41274 430010 WideCharToMultiByte 41274->41277 41276 42ff0c _strlen 41280 428cde __malloc_crt 58 API calls 41276->41280 41277->41266 41277->41270 41277->41274 41278 430157 __tzset_nolock __freefls@4 41277->41278 41279 43ff8e 58 API calls ___getlocaleinfo 41277->41279 41285 423c2d 61 API calls UnDecorator::getZName 41277->41285 41293 4242fd 8 API calls 2 library calls 41277->41293 41294 420bed 58 API calls 2 library calls 41277->41294 41295 4300d7 LeaveCriticalSection _doexit 41277->41295 41278->41236 41279->41277 41283 42ff1a _strlen 41280->41283 41281 42fed9 type_info::operator== 41281->41276 41281->41277 41291 420bed 58 API calls 2 library calls 41281->41291 41283->41277 41292 42c0fd 58 API calls __cftoe_l 41283->41292 41285->41277 41286->41232 41287->41265 41288->41269 41289->41272 41290->41281 41291->41276 41292->41277 41293->41277 41294->41277 41295->41277 41296->41248 41297->41250 41325 42019c 41298->41325 41301 4227d4 41333 425208 58 API calls __getptd_noexit 41301->41333 41303 4227d9 41334 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 41303->41334 41304 4227e9 MultiByteToWideChar 41306 422804 GetLastError 41304->41306 41307 422815 41304->41307 41335 4251e7 58 API calls 3 library calls 41306->41335 41310 428cde __malloc_crt 58 API calls 41307->41310 41308 40d7a3 41308->40952 41312 42281d 41310->41312 41311 422810 41338 420bed 58 API calls 2 library calls 41311->41338 41312->41311 41313 422825 MultiByteToWideChar 41312->41313 41313->41306 41315 42283f 41313->41315 41316 428cde __malloc_crt 58 API calls 41315->41316 41318 42284a 41316->41318 41317 4228a0 41339 420bed 58 API calls 2 library calls 41317->41339 41318->41311 41336 42d51e 88 API calls 3 library calls 41318->41336 41321 422866 41321->41311 41322 42286f WideCharToMultiByte 41321->41322 41322->41311 41323 42288b GetLastError 41322->41323 41337 4251e7 58 API calls 3 library calls 41323->41337 41326 4201ad 41325->41326 41332 4201fa 41325->41332 41340 425007 58 API calls 2 library calls 41326->41340 41328 4201b3 41329 4201da 41328->41329 41341 4245dc 58 API calls 6 library calls 41328->41341 41329->41332 41342 42495e 58 API calls 6 library calls 41329->41342 41332->41301 41332->41304 41333->41303 41334->41308 41335->41311 41336->41321 41337->41311 41338->41317 41339->41308 41340->41328 41341->41329 41342->41332 41343->40996 41346 427e1a __freefls@4 41345->41346 41347 428af7 __lock 51 API calls 41346->41347 41348 427e21 41347->41348 41349 427e4f RtlDecodePointer 41348->41349 41352 427eda _doexit 41348->41352 41351 427e66 DecodePointer 41349->41351 41349->41352 41358 427e76 41351->41358 41365 427f28 41352->41365 41354 427f37 __freefls@4 41354->40658 41356 427e83 EncodePointer 41356->41358 41357 427f1f 41359 427b0b _doexit 3 API calls 41357->41359 41358->41352 41358->41356 41361 427e93 DecodePointer EncodePointer 41358->41361 41360 427f28 41359->41360 41362 427f35 41360->41362 41370 428c81 LeaveCriticalSection 41360->41370 41363 427ea5 DecodePointer DecodePointer 41361->41363 41362->40658 41363->41358 41366 427f2e 41365->41366 41368 427f08 41365->41368 41371 428c81 LeaveCriticalSection 41366->41371 41368->41354 41369 428c81 LeaveCriticalSection 41368->41369 41369->41357 41370->41362 41371->41368

                                                                          Executed Functions

                                                                          Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
                                                                            • Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
                                                                            • Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
                                                                          • GetCurrentProcess.KERNEL32 ref: 00419FC4
                                                                          • GetLastError.KERNEL32 ref: 00419FD2
                                                                          • SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
                                                                          • GetLastError.KERNEL32 ref: 00419FE4
                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006DE488,?), ref: 0041A0BB
                                                                          • PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
                                                                          • GetCommandLineW.KERNEL32(?,?), ref: 0041A161
                                                                            • Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
                                                                            • Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
                                                                            • Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
                                                                          • String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
                                                                          • API String ID: 2957410896-3144399390
                                                                          • Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
                                                                          • Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
                                                                          • Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
                                                                          • Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702comCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 688 40d240-40d274 CoInitialize 689 40d276-40d278 688->689 690 40d27d-40d2dd CoInitializeSecurity call 414690 CoCreateInstance 688->690 691 40da8e-40da92 689->691 697 40d2e3-40d3ca VariantInit * 4 VariantClear * 4 690->697 698 40da3c-40da44 CoUninitialize 690->698 693 40da94-40da9c call 422587 691->693 694 40da9f-40dab1 691->694 693->694 704 40d3e2-40d3fe call 40b140 697->704 705 40d3cc-40d3dd CoUninitialize 697->705 700 40da69-40da6d 698->700 702 40da7a-40da8a 700->702 703 40da6f-40da77 call 422587 700->703 702->691 703->702 711 40d400-40d402 704->711 712 40d404 704->712 705->700 713 40d406-40d424 call 40b1d0 711->713 712->713 717 40d426-40d437 CoUninitialize 713->717 718 40d43c-40d451 call 40b140 713->718 717->700 722 40d453-40d455 718->722 723 40d457 718->723 724 40d459-40d494 call 40b1d0 722->724 723->724 730 40d496-40d4a7 CoUninitialize 724->730 731 40d4ac-40d4c2 724->731 730->700 734 40d4c8-40d4dd call 40b140 731->734 735 40da2a-40da37 731->735 739 40d4e3 734->739 740 40d4df-40d4e1 734->740 735->698 741 40d4e5-40d508 call 40b1d0 739->741 740->741 741->735 746 40d50e-40d524 741->746 746->735 748 40d52a-40d542 746->748 748->735 751 40d548-40d55e 748->751 751->735 753 40d564-40d57c 751->753 753->735 756 40d582-40d59b 753->756 756->735 758 40d5a1-40d5b6 call 40b140 756->758 761 40d5b8-40d5ba 758->761 762 40d5bc 758->762 763 40d5be-40d5e1 call 40b1d0 761->763 762->763 763->735 768 40d5e7-40d5fd 763->768 768->735 770 40d603-40d626 768->770 770->735 773 40d62c-40d651 770->773 773->735 776 40d657-40d666 773->776 776->735 778 40d66c-40d681 call 40b140 776->778 781 40d683-40d685 778->781 782 40d687 778->782 783 40d689-40d6a3 call 40b1d0 781->783 782->783 783->735 787 40d6a9-40d6be call 40b140 783->787 790 40d6c0-40d6c2 787->790 791 40d6c4 787->791 792 40d6c6-40d6e0 call 40b1d0 790->792 791->792 792->735 796 40d6e6-40d6f4 792->796 796->735 798 40d6fa-40d70f call 40b140 796->798 801 40d711-40d713 798->801 802 40d715 798->802 803 40d717-40d731 call 40b1d0 801->803 802->803 803->735 807 40d737-40d74c call 40b140 803->807 810 40d752 807->810 811 40d74e-40d750 807->811 812 40d754-40d76e call 40b1d0 810->812 811->812 812->735 816 40d774-40d7ce call 423aaf call 423551 call 4228e0 call 412c40 call 412900 812->816 827 40d7d0 816->827 828 40d7d2-40d7e3 call 40b140 816->828 827->828 831 40d7e5-40d7e7 828->831 832 40d7e9 828->832 833 40d7eb-40d819 call 40b1d0 call 413210 831->833 832->833 833->735 840 40d81f-40d835 833->840 840->735 842 40d83b-40d85e 840->842 842->735 845 40d864-40d889 842->845 845->735 848 40d88f-40d8ab call 40b140 845->848 851 40d8b1 848->851 852 40d8ad-40d8af 848->852 853 40d8b3-40d8cd call 40b1d0 851->853 852->853 857 40d8dd-40d8f2 call 40b140 853->857 858 40d8cf-40d8d8 853->858 862 40d8f4-40d8f6 857->862 863 40d8f8 857->863 858->735 864 40d8fa-40d91d call 40b1d0 862->864 863->864 864->735 869 40d923-40d98d call 40b400 VariantInit * 2 call 40b140 864->869 874 40d993 869->874 875 40d98f-40d991 869->875 876 40d995-40da0e call 40b1d0 VariantClear * 3 874->876 875->876 880 40da10-40da27 call 42052a 876->880 881 40da46-40da67 CoUninitialize 876->881 880->735 881->700
                                                                          APIs
                                                                          • CoInitialize.OLE32(00000000), ref: 0040D26C
                                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
                                                                          • CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
                                                                          • VariantInit.OLEAUT32(?), ref: 0040D2F0
                                                                          • VariantInit.OLEAUT32(?), ref: 0040D309
                                                                          • VariantInit.OLEAUT32(?), ref: 0040D322
                                                                          • VariantInit.OLEAUT32(?), ref: 0040D33B
                                                                          • VariantClear.OLEAUT32(?), ref: 0040D397
                                                                          • VariantClear.OLEAUT32(?), ref: 0040D3A4
                                                                          • VariantClear.OLEAUT32(?), ref: 0040D3B1
                                                                          • VariantClear.OLEAUT32(?), ref: 0040D3C2
                                                                          • CoUninitialize.OLE32 ref: 0040D3D5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
                                                                          • String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
                                                                          • API String ID: 2496729271-1738591096
                                                                          • Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
                                                                          • Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
                                                                          • Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
                                                                          • Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116libraryloaderCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetCommandLineW.KERNEL32 ref: 00412235
                                                                          • CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
                                                                          • PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
                                                                          • LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
                                                                          • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
                                                                          • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
                                                                          • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
                                                                          • LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
                                                                          • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
                                                                          • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
                                                                          • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
                                                                          • K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
                                                                          • OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
                                                                          • K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
                                                                          • K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
                                                                          • CloseHandle.KERNEL32(00000000), ref: 00412347
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
                                                                          • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
                                                                          • API String ID: 3668891214-3807497772
                                                                          • Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
                                                                          • Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
                                                                          • Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
                                                                          • Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228networkfileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 903 40cf10-40cfb0 call 42f7c0 call 42b420 InternetOpenW call 415c10 InternetOpenUrlW 910 40cfb2-40cfb4 903->910 911 40cfb9-40cffb InternetReadFile InternetCloseHandle * 2 call 4156d0 903->911 912 40d213-40d217 910->912 916 40d000-40d01d 911->916 914 40d224-40d236 912->914 915 40d219-40d221 call 422587 912->915 915->914 918 40d023-40d02c 916->918 919 40d01f-40d021 916->919 922 40d030-40d035 918->922 921 40d039-40d069 call 4156d0 call 414300 919->921 928 40d1cb 921->928 929 40d06f-40d08b call 413010 921->929 922->922 923 40d037 922->923 923->921 931 40d1cd-40d1d1 928->931 935 40d0b9-40d0bd 929->935 936 40d08d-40d091 929->936 933 40d1d3-40d1db call 422587 931->933 934 40d1de-40d1f4 931->934 933->934 938 40d201-40d20f 934->938 939 40d1f6-40d1fe call 422587 934->939 943 40d0cd-40d0e1 call 414300 935->943 944 40d0bf-40d0ca call 422587 935->944 940 40d093-40d09b call 422587 936->940 941 40d09e-40d0b4 call 413d40 936->941 938->912 939->938 940->941 941->935 943->928 954 40d0e7-40d149 call 413010 943->954 944->943 957 40d150-40d15a 954->957 958 40d160-40d162 957->958 959 40d15c-40d15e 957->959 961 40d165-40d16a 958->961 960 40d16e-40d18b call 40b650 959->960 965 40d19a-40d19e 960->965 966 40d18d-40d18f 960->966 961->961 962 40d16c 961->962 962->960 965->957 967 40d1a0 965->967 966->965 968 40d191-40d198 966->968 970 40d1a2-40d1a6 967->970 968->965 969 40d1c7-40d1c9 968->969 969->970 971 40d1b3-40d1c5 970->971 972 40d1a8-40d1b0 call 422587 970->972 971->931 972->971
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0040CF4A
                                                                          • InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
                                                                          • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
                                                                          • InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
                                                                          • InternetCloseHandle.WININET(00000000), ref: 0040CFDA
                                                                          • InternetCloseHandle.WININET(00000000), ref: 0040CFDD
                                                                          Strings
                                                                          • https://api.2ip.ua/geo.json, xrefs: 0040CF79
                                                                          • "country_code":", xrefs: 0040CFE1
                                                                          • Microsoft Internet Explorer, xrefs: 0040CF5A
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Internet$CloseHandleOpen$FileRead_memset
                                                                          • String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
                                                                          • API String ID: 1485416377-2962370585
                                                                          • Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                          • Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
                                                                          • Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                          • Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382stringregistrylibraryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 606 411cd0-411d1a call 42f7c0 RegOpenKeyExW 609 411d20-411d8d call 42b420 RegQueryValueExW RegCloseKey 606->609 610 412207-412216 606->610 613 411d93-411d9c 609->613 614 411d8f-411d91 609->614 616 411da0-411da9 613->616 615 411daf-411dcb call 415c10 614->615 620 411dd1-411df8 lstrlenA call 413520 615->620 621 411e7c-411e87 615->621 616->616 617 411dab-411dad 616->617 617->615 629 411e28-411e2c 620->629 630 411dfa-411dfe 620->630 623 411e94-411f34 LoadLibraryW GetProcAddress GetCommandLineW CommandLineToArgvW lstrcpyW PathFindFileNameW UuidCreate UuidToStringW 621->623 624 411e89-411e91 call 422587 621->624 633 411f36-411f38 623->633 634 411f3a-411f3f 623->634 624->623 631 411e3c-411e50 PathFileExistsW 629->631 632 411e2e-411e39 call 422587 629->632 635 411e00-411e08 call 422587 630->635 636 411e0b-411e23 call 4145a0 630->636 631->621 641 411e52-411e57 631->641 632->631 639 411f4f-411f96 call 415c10 RpcStringFreeW PathAppendW CreateDirectoryW 633->639 640 411f40-411f49 634->640 635->636 636->629 653 411f98-411fa0 639->653 654 411fce-411fe9 639->654 640->640 645 411f4b-411f4d 640->645 646 411e59-411e5e 641->646 647 411e6a-411e6e 641->647 645->639 646->647 649 411e60-411e65 call 414690 646->649 647->610 651 411e74-411e77 647->651 649->647 655 4121ff-412204 call 422587 651->655 658 411fa2-411fa4 653->658 659 411fa6-411faf 653->659 656 411feb-411fed 654->656 657 411fef-411ff8 654->657 655->610 661 41200f-412076 call 415c10 PathAppendW DeleteFileW CopyFileW RegOpenKeyExW 656->661 662 412000-412009 657->662 663 411fbf-411fc9 call 415c10 658->663 665 411fb0-411fb9 659->665 671 4121d1-4121d5 661->671 672 41207c-412107 call 42b420 lstrcpyW lstrcatW * 2 lstrlenW RegSetValueExW RegCloseKey 661->672 662->662 668 41200b-41200d 662->668 663->654 665->665 666 411fbb-411fbd 665->666 666->663 668->661 673 4121e2-4121fa 671->673 674 4121d7-4121df call 422587 671->674 680 412115-4121a8 call 42b420 SetLastError lstrcpyW lstrcatW * 2 CreateProcessW 672->680 681 412109-412110 call 413260 672->681 673->610 677 4121fc 673->677 674->673 677->655 685 4121b2-4121b8 680->685 686 4121aa-4121b0 GetLastError 680->686 681->680 687 4121c0-4121cf WaitForSingleObject 685->687 686->671 687->671 687->687
                                                                          APIs
                                                                          • RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
                                                                          • _memset.LIBCMT ref: 00411D3B
                                                                          • RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
                                                                          • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
                                                                          • lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
                                                                          • PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
                                                                          • LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
                                                                          • GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
                                                                          • GetCommandLineW.KERNEL32 ref: 00411EB4
                                                                          • CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
                                                                          • lstrcpyW.KERNEL32 ref: 00411ECE
                                                                          • PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
                                                                          • UuidCreate.RPCRT4(?), ref: 00411EFC
                                                                          • UuidToStringW.RPCRT4(?,?), ref: 00411F14
                                                                          • RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
                                                                          • PathAppendW.SHLWAPI(?,?), ref: 00411F83
                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
                                                                          • PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
                                                                          • DeleteFileW.KERNEL32(?), ref: 00412036
                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
                                                                          • RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
                                                                          • _memset.LIBCMT ref: 00412090
                                                                          • lstrcpyW.KERNEL32 ref: 004120AA
                                                                          • lstrcatW.KERNEL32(?,?), ref: 004120C0
                                                                          • lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
                                                                          • lstrlenW.KERNEL32(?), ref: 004120D7
                                                                          • RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 004120FC
                                                                          • _memset.LIBCMT ref: 00412120
                                                                          • SetLastError.KERNEL32(00000000), ref: 00412146
                                                                          • lstrcpyW.KERNEL32 ref: 00412158
                                                                          • lstrcatW.KERNEL32(?,?), ref: 0041216D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
                                                                          • String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
                                                                          • API String ID: 2589766509-1182136429
                                                                          • Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                          • Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
                                                                          • Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                          • Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 975 423576-42358f 976 423591-42359b call 425208 call 4242d2 975->976 977 4235a9-4235be call 42b420 975->977 984 4235a0 976->984 977->976 983 4235c0-4235c3 977->983 985 4235d7-4235dd 983->985 986 4235c5 983->986 991 4235a2-4235a8 984->991 989 4235e9 call 42fb64 985->989 990 4235df 985->990 987 4235c7-4235c9 986->987 988 4235cb-4235d5 call 425208 986->988 987->985 987->988 988->984 996 4235ee-4235fa call 42f803 989->996 990->988 993 4235e1-4235e7 990->993 993->988 993->989 999 423600-42360c call 42f82d 996->999 1000 4237e5-4237ef call 4242fd 996->1000 999->1000 1005 423612-42361e call 42f857 999->1005 1005->1000 1008 423624-42362b 1005->1008 1009 42369b-4236a6 call 42f939 1008->1009 1010 42362d 1008->1010 1009->991 1016 4236ac-4236af 1009->1016 1012 423637-423653 call 42f939 1010->1012 1013 42362f-423635 1010->1013 1012->991 1020 423659-42365c 1012->1020 1013->1009 1013->1012 1018 4236b1-4236ba call 42fbb4 1016->1018 1019 4236de-4236eb 1016->1019 1018->1019 1028 4236bc-4236dc 1018->1028 1022 4236ed-4236fc call 4305a0 1019->1022 1023 423662-42366b call 42fbb4 1020->1023 1024 42379e-4237a0 1020->1024 1031 423709-423730 call 4304f0 call 4305a0 1022->1031 1032 4236fe-423706 1022->1032 1023->1024 1033 423671-423689 call 42f939 1023->1033 1024->991 1028->1022 1041 423732-42373b 1031->1041 1042 42373e-423765 call 4304f0 call 4305a0 1031->1042 1032->1031 1033->991 1039 42368f-423696 1033->1039 1039->1024 1041->1042 1047 423773-423782 call 4304f0 1042->1047 1048 423767-423770 1042->1048 1051 423784 1047->1051 1052 4237af-4237c8 1047->1052 1048->1047 1055 423786-423788 1051->1055 1056 42378a-423798 1051->1056 1053 4237ca-4237e3 1052->1053 1054 42379b 1052->1054 1053->1024 1054->1024 1055->1056 1057 4237a5-4237a7 1055->1057 1056->1054 1057->1024 1058 4237a9 1057->1058 1058->1052 1059 4237ab-4237ad 1058->1059 1059->1024 1059->1052
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 004235B1
                                                                            • Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208
                                                                          • __gmtime64_s.LIBCMT ref: 0042364A
                                                                          • __gmtime64_s.LIBCMT ref: 00423680
                                                                          • __gmtime64_s.LIBCMT ref: 0042369D
                                                                          • __allrem.LIBCMT ref: 004236F3
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
                                                                          • __allrem.LIBCMT ref: 00423726
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
                                                                          • __allrem.LIBCMT ref: 0042375B
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
                                                                          • String ID:
                                                                          • API String ID: 1503770280-0
                                                                          • Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                          • Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
                                                                          • Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                          • Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1060 427b0b-427b1a call 427ad7 ExitProcess
                                                                          APIs
                                                                          • ___crtCorExitProcess.LIBCMT ref: 00427B11
                                                                            • Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
                                                                            • Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8
                                                                          • ExitProcess.KERNEL32 ref: 00427B1A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                          • String ID: i;B
                                                                          • API String ID: 2427264223-472376889
                                                                          • Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
                                                                          • Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
                                                                          • Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
                                                                          • Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1063 42fb64-42fb77 call 428520 1066 42fba5-42fbaa call 428565 1063->1066 1067 42fb79-42fb8c call 428af7 1063->1067 1072 42fb99-42fba0 call 42fbab 1067->1072 1073 42fb8e call 42fe47 1067->1073 1072->1066 1076 42fb93 1073->1076 1076->1072
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 0042FB7B
                                                                            • Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
                                                                            • Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
                                                                            • Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22
                                                                          • __tzset_nolock.LIBCMT ref: 0042FB8E
                                                                            • Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
                                                                            • Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
                                                                            • Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
                                                                            • Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
                                                                            • Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
                                                                            • Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
                                                                          • String ID:
                                                                          • API String ID: 1282695788-0
                                                                          • Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
                                                                          • Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
                                                                          • Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
                                                                          • Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1077 427f3d-427f47 call 427e0e 1079 427f4c-427f50 1077->1079
                                                                          APIs
                                                                          • _doexit.LIBCMT ref: 00427F47
                                                                            • Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
                                                                            • Part of subcall function 00427E0E: RtlDecodePointer.NTDLL(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
                                                                            • Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
                                                                            • Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
                                                                            • Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
                                                                            • Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
                                                                            • Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
                                                                            • Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Pointer$Decode$Encode$__lock_doexit
                                                                          • String ID:
                                                                          • API String ID: 2158581194-0
                                                                          • Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                                                          • Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
                                                                          • Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                                                          • Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
                                                                          • __CxxThrowException@8.LIBCMT ref: 00411026
                                                                            • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                          • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
                                                                          • __CxxThrowException@8.LIBCMT ref: 00411051
                                                                          • lstrlenA.KERNEL32(?,00000000), ref: 00411059
                                                                          • CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
                                                                          • __CxxThrowException@8.LIBCMT ref: 0041107A
                                                                          • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
                                                                          • __CxxThrowException@8.LIBCMT ref: 004110AB
                                                                          • _memset.LIBCMT ref: 004110CA
                                                                          • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
                                                                          • __CxxThrowException@8.LIBCMT ref: 004110F0
                                                                          • _malloc.LIBCMT ref: 00411100
                                                                          • _memset.LIBCMT ref: 0041110B
                                                                          • _sprintf.LIBCMT ref: 0041112E
                                                                          • lstrcatA.KERNEL32(?,?), ref: 0041113C
                                                                          • CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
                                                                          • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
                                                                          • String ID: %.2X
                                                                          • API String ID: 2451520719-213608013
                                                                          • Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
                                                                          • Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
                                                                          • Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
                                                                          • Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLastError.KERNEL32 ref: 00411915
                                                                          • FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
                                                                          • lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
                                                                          • lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
                                                                          • LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
                                                                          • lstrcpyW.KERNEL32 ref: 00411962
                                                                          • lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
                                                                          • lstrcatW.KERNEL32(00000000,?), ref: 0041198B
                                                                          • lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
                                                                          • lstrcatW.KERNEL32(00000000,?), ref: 00411999
                                                                          • lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
                                                                          • _memset.LIBCMT ref: 004119B8
                                                                          • lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC
                                                                            • Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9
                                                                          • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
                                                                          • LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
                                                                          • String ID: failed with error
                                                                          • API String ID: 4182478520-946485432
                                                                          • Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
                                                                          • Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
                                                                          • Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
                                                                          • Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411ACA
                                                                            • Part of subcall function 00411AB0: DispatchMessageW.USER32 ref: 00411AE0
                                                                            • Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411AEE
                                                                          • PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
                                                                          • _memmove.LIBCMT ref: 0040F9EA
                                                                          • PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
                                                                          • _memmove.LIBCMT ref: 0040FADA
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Message$FileFindNamePathPeek_memmove$Dispatch
                                                                          • String ID:
                                                                          • API String ID: 273148273-0
                                                                          • Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
                                                                          • Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
                                                                          • Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
                                                                          • Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004822E0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 127windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
                                                                            • Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
                                                                            • Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
                                                                            • Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
                                                                            • Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
                                                                            • Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
                                                                            • Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
                                                                            • Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A
                                                                          • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 00482323
                                                                          • GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
                                                                          • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
                                                                          • CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0048235C
                                                                          • GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
                                                                          • BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
                                                                          • GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
                                                                          • SelectObject.GDI32(?,?), ref: 00482436
                                                                          • DeleteObject.GDI32(00000000), ref: 0048243D
                                                                          • DeleteDC.GDI32(?), ref: 0048244A
                                                                          • DeleteDC.GDI32(?), ref: 00482450
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
                                                                          • String ID: .\crypto\rand\rand_win.c$DISPLAY$p[#w
                                                                          • API String ID: 151064509-1779478760
                                                                          • Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
                                                                          • Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
                                                                          • Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
                                                                          • Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040E8E4
                                                                            • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                          • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040E90F
                                                                          • CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040E93E
                                                                          • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040E96F
                                                                          • _memset.LIBCMT ref: 0040E98E
                                                                          • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040E9B4
                                                                          • _sprintf.LIBCMT ref: 0040E9D3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
                                                                          • String ID: %.2X
                                                                          • API String ID: 1084002244-213608013
                                                                          • Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                          • Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
                                                                          • Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                          • Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040EB17
                                                                            • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                          • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040EB42
                                                                          • CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040EB64
                                                                          • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040EB95
                                                                          • _memset.LIBCMT ref: 0040EBB4
                                                                          • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
                                                                          • __CxxThrowException@8.LIBCMT ref: 0040EBDA
                                                                          • _sprintf.LIBCMT ref: 0040EBF4
                                                                          • CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
                                                                          • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
                                                                          • String ID: %.2X
                                                                          • API String ID: 1637485200-213608013
                                                                          • Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                          • Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
                                                                          • Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                          • Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 0040E67F
                                                                            • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                            • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                            • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                          • _malloc.LIBCMT ref: 0040E68B
                                                                          • _wprintf.LIBCMT ref: 0040E69E
                                                                          • _free.LIBCMT ref: 0040E6A4
                                                                            • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                            • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                          • GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
                                                                          • _free.LIBCMT ref: 0040E6C5
                                                                          • _malloc.LIBCMT ref: 0040E6CD
                                                                          • GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
                                                                          • _sprintf.LIBCMT ref: 0040E720
                                                                          • _wprintf.LIBCMT ref: 0040E732
                                                                          • _wprintf.LIBCMT ref: 0040E73C
                                                                          • _free.LIBCMT ref: 0040E745
                                                                          Strings
                                                                          • Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
                                                                          • Address: %s, mac: %s, xrefs: 0040E72D
                                                                          • %02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
                                                                          • String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
                                                                          • API String ID: 3901070236-1604013687
                                                                          • Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
                                                                          • Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
                                                                          • Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
                                                                          • Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411ACA
                                                                            • Part of subcall function 00411AB0: DispatchMessageW.USER32 ref: 00411AE0
                                                                            • Part of subcall function 00411AB0: PeekMessageW.USER32 ref: 00411AEE
                                                                          • PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
                                                                          • _memmove.LIBCMT ref: 00410427
                                                                          • PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
                                                                          • _memmove.LIBCMT ref: 00410514
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Message$FileFindNamePathPeek_memmove$Dispatch
                                                                          • String ID:
                                                                          • API String ID: 273148273-0
                                                                          • Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
                                                                          • Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
                                                                          • Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
                                                                          • Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
                                                                          • String ID:
                                                                          • API String ID: 3232302685-0
                                                                          • Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
                                                                          • Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
                                                                          • Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
                                                                          • Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
                                                                          • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: InfoLocale
                                                                          • String ID: ACP$OCP
                                                                          • API String ID: 2299586839-711371036
                                                                          • Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
                                                                          • Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
                                                                          • Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
                                                                          • Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          • input != nullptr && output != nullptr, xrefs: 0040C095
                                                                          • e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __wassert
                                                                          • String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
                                                                          • API String ID: 3993402318-1975116136
                                                                          • Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
                                                                          • Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
                                                                          • Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
                                                                          • Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0042419D
                                                                          • IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: DebuggerPresent_memset
                                                                          • String ID: i;B
                                                                          • API String ID: 2328436684-472376889
                                                                          • Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
                                                                          • Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
                                                                          • Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
                                                                          • Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CryptDestroyHash.ADVAPI32(?), ref: 00411190
                                                                          • CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Crypt$ContextDestroyHashRelease
                                                                          • String ID:
                                                                          • API String ID: 3989222877-0
                                                                          • Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
                                                                          • Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
                                                                          • Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
                                                                          • Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
                                                                          • CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Crypt$ContextDestroyHashRelease
                                                                          • String ID:
                                                                          • API String ID: 3989222877-0
                                                                          • Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
                                                                          • Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
                                                                          • Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
                                                                          • Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
                                                                          • CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Crypt$ContextDestroyHashRelease
                                                                          • String ID:
                                                                          • API String ID: 3989222877-0
                                                                          • Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
                                                                          • Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
                                                                          • Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
                                                                          • Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
                                                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ExceptionFilterUnhandled
                                                                          • String ID:
                                                                          • API String ID: 3192549508-0
                                                                          • Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
                                                                          • Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
                                                                          • Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
                                                                          • Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ExceptionFilterUnhandled
                                                                          • String ID:
                                                                          • API String ID: 3192549508-0
                                                                          • Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
                                                                          • Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
                                                                          • Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
                                                                          • Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: HeapProcess
                                                                          • String ID:
                                                                          • API String ID: 54951025-0
                                                                          • Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
                                                                          • Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
                                                                          • Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
                                                                          • Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
                                                                          • GetLastError.KERNEL32 ref: 00412509
                                                                          • CloseHandle.KERNEL32 ref: 0041251C
                                                                          • CloseHandle.KERNEL32 ref: 00412539
                                                                          • CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
                                                                          • GetLastError.KERNEL32 ref: 0041255B
                                                                          • CloseHandle.KERNEL32 ref: 0041256E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CloseHandle$CreateErrorLastMutex
                                                                          • String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
                                                                          • API String ID: 2372642624-488272950
                                                                          • Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
                                                                          • Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
                                                                          • Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
                                                                          • Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _strncmp
                                                                          • String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
                                                                          • API String ID: 909875538-2733969777
                                                                          • Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
                                                                          • Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
                                                                          • Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
                                                                          • Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
                                                                          • String ID:
                                                                          • API String ID: 1503006713-0
                                                                          • Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                          • Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
                                                                          • Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                          • Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostQuitMessage.USER32(00000000), ref: 0041BB49
                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
                                                                          • _malloc.LIBCMT ref: 0041BBE4
                                                                          • GetComputerNameW.KERNEL32 ref: 0041BBF4
                                                                          • _free.LIBCMT ref: 0041BCD7
                                                                            • Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
                                                                            • Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
                                                                            • Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
                                                                            • Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
                                                                            • Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
                                                                            • Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
                                                                          • IsWindow.USER32(?), ref: 0041BF69
                                                                          • DestroyWindow.USER32(?), ref: 0041BF7B
                                                                          • DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
                                                                          • String ID:
                                                                          • API String ID: 3873257347-0
                                                                          • Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
                                                                          • Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
                                                                          • Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
                                                                          • Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DecodePointer.KERNEL32 ref: 00427B29
                                                                          • _free.LIBCMT ref: 00427B42
                                                                            • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                            • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                          • _free.LIBCMT ref: 00427B55
                                                                          • _free.LIBCMT ref: 00427B73
                                                                          • _free.LIBCMT ref: 00427B85
                                                                          • _free.LIBCMT ref: 00427B96
                                                                          • _free.LIBCMT ref: 00427BA1
                                                                          • _free.LIBCMT ref: 00427BC5
                                                                          • EncodePointer.KERNEL32(006D90B8), ref: 00427BCC
                                                                          • _free.LIBCMT ref: 00427BE1
                                                                          • _free.LIBCMT ref: 00427BF7
                                                                          • _free.LIBCMT ref: 00427C1F
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
                                                                          • String ID:
                                                                          • API String ID: 3064303923-0
                                                                          • Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
                                                                          • Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
                                                                          • Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
                                                                          • Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CoInitialize.OLE32(00000000), ref: 00411BB0
                                                                          • CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
                                                                          • CoUninitialize.OLE32 ref: 00411BD0
                                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
                                                                          • SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
                                                                          • lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
                                                                          • lstrcatW.KERNEL32(?), ref: 00411C44
                                                                          • GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
                                                                          • lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
                                                                          • String ID: \shell32.dll
                                                                          • API String ID: 679253221-3783449302
                                                                          • Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
                                                                          • Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
                                                                          • Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
                                                                          • Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
                                                                          • GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
                                                                          • GetDesktopWindow.USER32 ref: 004549FB
                                                                          • GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
                                                                          • GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
                                                                          • GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
                                                                          • GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
                                                                          • _wcsstr.LIBCMT ref: 00454A8A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
                                                                          • String ID: Service-0x$_OPENSSL_isservice
                                                                          • API String ID: 2112994598-1672312481
                                                                          • Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
                                                                          • Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
                                                                          • Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
                                                                          • Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
                                                                          • GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
                                                                          • __vfwprintf_p.LIBCMT ref: 00454B27
                                                                            • Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF
                                                                          • vswprintf.LIBCMT ref: 00454B5D
                                                                          • RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
                                                                          • ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
                                                                          • DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
                                                                          • MessageBoxA.USER32 ref: 00454BD3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
                                                                          • String ID: OPENSSL$OpenSSL: FATAL
                                                                          • API String ID: 277090408-1348657634
                                                                          • Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
                                                                          • Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
                                                                          • Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
                                                                          • Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
                                                                          • _memset.LIBCMT ref: 004123B6
                                                                          • RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
                                                                          • RegCloseKey.ADVAPI32(?), ref: 004123E7
                                                                          • GetCommandLineW.KERNEL32 ref: 004123F4
                                                                          • CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
                                                                          • lstrcpyW.KERNEL32 ref: 0041240E
                                                                          • lstrcmpW.KERNEL32(?,?), ref: 00412422
                                                                          Strings
                                                                          • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
                                                                          • SysHelper, xrefs: 004123D6
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
                                                                          • API String ID: 122392481-4165002228
                                                                          • Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
                                                                          • Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
                                                                          • Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
                                                                          • Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memmove
                                                                          • String ID: invalid string position$string too long
                                                                          • API String ID: 4104443479-4289949731
                                                                          • Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
                                                                          • Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
                                                                          • Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
                                                                          • Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CoInitialize.OLE32(00000000), ref: 0040DAEB
                                                                          • CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
                                                                          • lstrcpyW.KERNEL32 ref: 0040DBD6
                                                                          • PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
                                                                          • _memset.LIBCMT ref: 0040DC38
                                                                          • CoUninitialize.OLE32 ref: 0040DC92
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
                                                                          • String ID: --Task$Comment$Time Trigger Task
                                                                          • API String ID: 330603062-1376107329
                                                                          • Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
                                                                          • Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
                                                                          • Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
                                                                          • Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
                                                                          • OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
                                                                          • ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
                                                                          • QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
                                                                          • Sleep.KERNEL32(?), ref: 00411A75
                                                                          • QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
                                                                          • String ID: MYSQL
                                                                          • API String ID: 2359367111-1651825290
                                                                          • Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
                                                                          • Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
                                                                          • Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
                                                                          • Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • std::exception::exception.LIBCMT ref: 0044F27F
                                                                            • Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15
                                                                          • __CxxThrowException@8.LIBCMT ref: 0044F294
                                                                            • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                          • std::exception::exception.LIBCMT ref: 0044F2AD
                                                                          • __CxxThrowException@8.LIBCMT ref: 0044F2C2
                                                                          • std::regex_error::regex_error.LIBCPMT ref: 0044F2D4
                                                                            • Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E
                                                                          • __CxxThrowException@8.LIBCMT ref: 0044F2E2
                                                                          • std::exception::exception.LIBCMT ref: 0044F2FB
                                                                          • __CxxThrowException@8.LIBCMT ref: 0044F310
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
                                                                          • String ID: bad function call
                                                                          • API String ID: 2464034642-3612616537
                                                                          • Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                          • Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
                                                                          • Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                          • Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
                                                                          • GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
                                                                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
                                                                          • GetLastError.KERNEL32(?,?,00000000), ref: 00465503
                                                                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
                                                                          • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
                                                                          • GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ByteCharMultiWide$ErrorLast
                                                                          • String ID: ','$.\crypto\bio\bss_file.c$fopen('
                                                                          • API String ID: 1717984340-2085858615
                                                                          • Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
                                                                          • Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
                                                                          • Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
                                                                          • Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
                                                                          • String ID:
                                                                          • API String ID: 790675137-0
                                                                          • Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                          • Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
                                                                          • Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                          • Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8
                                                                          • _fgetws.LIBCMT ref: 0040C7BC
                                                                          • _memmove.LIBCMT ref: 0040C89F
                                                                          • CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CreateDirectory__wfsopen_fgetws_memmove
                                                                          • String ID: C:\SystemID$C:\SystemID\PersonalID.txt
                                                                          • API String ID: 2864494435-54166481
                                                                          • Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                          • Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
                                                                          • Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                          • Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
                                                                          • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
                                                                          • TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
                                                                          • CloseHandle.KERNEL32(00000000), ref: 004124B7
                                                                          • Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
                                                                          • CloseHandle.KERNEL32(00000000), ref: 004124CD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                                                          • String ID: cmd.exe
                                                                          • API String ID: 2696918072-723907552
                                                                          • Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
                                                                          • Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
                                                                          • Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
                                                                          • Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
                                                                          • GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: SHGetFolderPathW$Shell32.dll$\
                                                                          • API String ID: 2574300362-2555811374
                                                                          • Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
                                                                          • Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
                                                                          • Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
                                                                          • Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _malloc$__except_handler4_fprintf
                                                                          • String ID: &#160;$Error encrypting message: %s$\\n
                                                                          • API String ID: 1783060780-3771355929
                                                                          • Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
                                                                          • Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
                                                                          • Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
                                                                          • Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _strncmp
                                                                          • String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
                                                                          • API String ID: 909875538-2908105608
                                                                          • Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
                                                                          • Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
                                                                          • Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
                                                                          • Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
                                                                          • RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0040C700
                                                                          • RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0040C72E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: CloseValue$OpenQuery
                                                                          • String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
                                                                          • API String ID: 3962714758-1667468722
                                                                          • Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
                                                                          • Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
                                                                          • Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
                                                                          • Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0041E707
                                                                            • Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
                                                                          • InternetOpenW.WININET ref: 0041E743
                                                                          • _wcsstr.LIBCMT ref: 0041E7AE
                                                                          • _memmove.LIBCMT ref: 0041E838
                                                                          • lstrcpyW.KERNEL32 ref: 0041E90A
                                                                          • lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
                                                                          • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
                                                                          • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
                                                                          • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
                                                                          • lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
                                                                          • InternetCloseHandle.WININET(00000000), ref: 0041E9F3
                                                                          • InternetCloseHandle.WININET(00000000), ref: 0041E9F6
                                                                          • _strstr.LIBCMT ref: 0041EA36
                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
                                                                          • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
                                                                          • DeleteFileA.KERNEL32(?), ref: 0041EA82
                                                                          • lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
                                                                          • lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
                                                                          • lstrcpyA.KERNEL32(?,?), ref: 0041EABA
                                                                          • lstrlenA.KERNEL32(?), ref: 0041EAC8
                                                                          • lstrlenA.KERNEL32(00000022), ref: 0041EAE3
                                                                          • lstrcpyW.KERNEL32 ref: 0041EB5B
                                                                          • lstrlenA.KERNEL32(?), ref: 0041EB7C
                                                                          • _malloc.LIBCMT ref: 0041EB86
                                                                          • _memset.LIBCMT ref: 0041EB94
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
                                                                          • lstrcpyW.KERNEL32 ref: 0041EBB6
                                                                          • _strstr.LIBCMT ref: 0041EBDA
                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
                                                                          • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
                                                                          • DeleteFileA.KERNEL32(?), ref: 0041EC32
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
                                                                          • String ID: bowsakkdestx.txt${"public_key":"
                                                                          • API String ID: 2805819797-1771568745
                                                                          • Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
                                                                          • Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
                                                                          • Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
                                                                          • Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __aulldvrm
                                                                          • String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
                                                                          • API String ID: 1302938615-3129329331
                                                                          • Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
                                                                          • Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
                                                                          • Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
                                                                          • Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___unDName.LIBCMT ref: 0043071B
                                                                          • _strlen.LIBCMT ref: 0043072E
                                                                          • __lock.LIBCMT ref: 0043074A
                                                                          • _malloc.LIBCMT ref: 0043075C
                                                                          • _malloc.LIBCMT ref: 0043076D
                                                                          • _free.LIBCMT ref: 004307B6
                                                                            • Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF
                                                                          • _free.LIBCMT ref: 004307AF
                                                                            • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                            • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
                                                                          • String ID:
                                                                          • API String ID: 3704956918-0
                                                                          • Opcode ID: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
                                                                          • Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
                                                                          • Opcode Fuzzy Hash: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
                                                                          • Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: MessageTimetime$Peek$DispatchSleep
                                                                          • String ID:
                                                                          • API String ID: 3697694649-0
                                                                          • Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
                                                                          • Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
                                                                          • Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
                                                                          • Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __init_pointers.LIBCMT ref: 00425141
                                                                            • Part of subcall function 00427D6C: RtlEncodePointer.NTDLL(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
                                                                            • Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
                                                                            • Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
                                                                            • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1
                                                                          • __mtinitlocks.LIBCMT ref: 00425146
                                                                          • __mtterm.LIBCMT ref: 0042514F
                                                                            • Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
                                                                            • Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
                                                                            • Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B
                                                                          • __calloc_crt.LIBCMT ref: 00425174
                                                                          • __initptd.LIBCMT ref: 00425196
                                                                          • GetCurrentThreadId.KERNEL32 ref: 0042519D
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                                                          • String ID:
                                                                          • API String ID: 3567560977-0
                                                                          • Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
                                                                          • Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
                                                                          • Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
                                                                          • Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 0042594A
                                                                            • Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
                                                                            • Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
                                                                            • Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22
                                                                          • _free.LIBCMT ref: 00425970
                                                                            • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                            • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                          • __lock.LIBCMT ref: 00425989
                                                                          • ___removelocaleref.LIBCMT ref: 00425998
                                                                          • ___freetlocinfo.LIBCMT ref: 004259B1
                                                                          • _free.LIBCMT ref: 004259C4
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
                                                                          • String ID:
                                                                          • API String ID: 626533743-0
                                                                          • Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
                                                                          • Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
                                                                          • Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
                                                                          • Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___from_strstr_to_strchr.LIBCMT ref: 004507C3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ___from_strstr_to_strchr
                                                                          • String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
                                                                          • API String ID: 601868998-2416195885
                                                                          • Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
                                                                          • Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
                                                                          • Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
                                                                          • Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID: .\crypto\buffer\buffer.c$g9F
                                                                          • API String ID: 2102423945-3653307630
                                                                          • Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
                                                                          • Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
                                                                          • Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
                                                                          • Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getptd_noexit.LIBCMT ref: 004C5D3D
                                                                            • Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
                                                                            • Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
                                                                            • Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
                                                                            • Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
                                                                            • Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083
                                                                          • __calloc_crt.LIBCMT ref: 004C5D60
                                                                          • __get_sys_err_msg.LIBCMT ref: 004C5D7E
                                                                          • __get_sys_err_msg.LIBCMT ref: 004C5DCD
                                                                          Strings
                                                                          • Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
                                                                          • String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
                                                                          • API String ID: 3123740607-798102604
                                                                          • Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                          • Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
                                                                          • Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                          • Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _fprintf_memset
                                                                          • String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
                                                                          • API String ID: 3021507156-3399676524
                                                                          • Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
                                                                          • Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
                                                                          • Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
                                                                          • Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
                                                                          • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Path$AppendFolder
                                                                          • String ID: bowsakkdestx.txt
                                                                          • API String ID: 29327785-2616962270
                                                                          • Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
                                                                          • Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
                                                                          • Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
                                                                          • Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateWindowExW.USER32 ref: 0041BAAD
                                                                          • ShowWindow.USER32(00000000,00000000), ref: 0041BABE
                                                                          • UpdateWindow.USER32(00000000), ref: 0041BAC5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Window$CreateShowUpdate
                                                                          • String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
                                                                          • API String ID: 2944774295-3503800400
                                                                          • Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
                                                                          • Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
                                                                          • Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
                                                                          • Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
                                                                          • GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
                                                                          • _memset.LIBCMT ref: 00410C4C
                                                                          • WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Enum$AllocGlobalOpenResource_memset
                                                                          • String ID:
                                                                          • API String ID: 364255426-0
                                                                          • Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
                                                                          • Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
                                                                          • Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
                                                                          • Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getenv_helper_nolock.LIBCMT ref: 00441726
                                                                          • _strlen.LIBCMT ref: 00441734
                                                                            • Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208
                                                                          • _strnlen.LIBCMT ref: 004417BF
                                                                          • __lock.LIBCMT ref: 004417D0
                                                                          • __getenv_helper_nolock.LIBCMT ref: 004417DB
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
                                                                          • String ID:
                                                                          • API String ID: 2168648987-0
                                                                          • Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                          • Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
                                                                          • Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                          • Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLogicalDrives.KERNEL32 ref: 00410A75
                                                                          • SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
                                                                          • PathFileExistsA.SHLWAPI(?), ref: 00410AF9
                                                                          • SetErrorMode.KERNEL32(00000000), ref: 00410B02
                                                                          • GetDriveTypeA.KERNEL32(?), ref: 00410B1B
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
                                                                          • String ID:
                                                                          • API String ID: 2560635915-0
                                                                          • Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
                                                                          • Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
                                                                          • Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
                                                                          • Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 0043B70B
                                                                            • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                            • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                            • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                          • _free.LIBCMT ref: 0043B71E
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateHeap_free_malloc
                                                                          • String ID:
                                                                          • API String ID: 1020059152-0
                                                                          • Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
                                                                          • Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
                                                                          • Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
                                                                          • Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                          • String ID:
                                                                          • API String ID: 1380987712-0
                                                                          • Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
                                                                          • Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
                                                                          • Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
                                                                          • Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                          • String ID:
                                                                          • API String ID: 1380987712-0
                                                                          • Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
                                                                          • Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
                                                                          • Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
                                                                          • Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostThreadMessageW.USER32 ref: 0041FA53
                                                                          • PeekMessageW.USER32 ref: 0041FA71
                                                                          • DispatchMessageW.USER32 ref: 0041FA7B
                                                                          • PeekMessageW.USER32 ref: 0041FA89
                                                                          • WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                          • String ID:
                                                                          • API String ID: 1380987712-0
                                                                          • Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                          • Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
                                                                          • Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                          • Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostThreadMessageW.USER32 ref: 0041FE03
                                                                          • PeekMessageW.USER32 ref: 0041FE21
                                                                          • DispatchMessageW.USER32 ref: 0041FE2B
                                                                          • PeekMessageW.USER32 ref: 0041FE39
                                                                          • WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                          • String ID:
                                                                          • API String ID: 1380987712-0
                                                                          • Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                          • Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
                                                                          • Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                          • Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memmove
                                                                          • String ID: invalid string position$string too long
                                                                          • API String ID: 4104443479-4289949731
                                                                          • Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
                                                                          • Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
                                                                          • Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
                                                                          • Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memmove
                                                                          • String ID: invalid string position$string too long
                                                                          • API String ID: 4104443479-4289949731
                                                                          • Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
                                                                          • Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
                                                                          • Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
                                                                          • Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _wcsnlen
                                                                          • String ID: U
                                                                          • API String ID: 3628947076-3372436214
                                                                          • Opcode ID: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
                                                                          • Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
                                                                          • Opcode Fuzzy Hash: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
                                                                          • Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID: .\crypto\buffer\buffer.c$C7F
                                                                          • API String ID: 2102423945-2013712220
                                                                          • Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
                                                                          • Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
                                                                          • Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
                                                                          • Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          • 8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: StringUuid$CreateFree
                                                                          • String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
                                                                          • API String ID: 3044360575-2335240114
                                                                          • Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
                                                                          • Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
                                                                          • Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
                                                                          • Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
                                                                          • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Path$AppendFolder
                                                                          • String ID: bowsakkdestx.txt
                                                                          • API String ID: 29327785-2616962270
                                                                          • Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
                                                                          • Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
                                                                          • Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
                                                                          • Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _malloc.LIBCMT ref: 00423B64
                                                                            • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                            • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                            • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                          • std::exception::exception.LIBCMT ref: 00423B82
                                                                          • __CxxThrowException@8.LIBCMT ref: 00423B97
                                                                            • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
                                                                          • String ID: bad allocation
                                                                          • API String ID: 3074076210-2104205924
                                                                          • Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
                                                                          • Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
                                                                          • Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
                                                                          • Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
                                                                          • RegisterClassExW.USER32 ref: 0041BA73
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ClassCursorLoadRegister
                                                                          • String ID: 0$LPCWSTRszWindowClass
                                                                          • API String ID: 1693014935-1496217519
                                                                          • Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
                                                                          • Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
                                                                          • Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
                                                                          • Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
                                                                          • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
                                                                          • DeleteFileA.KERNEL32(?), ref: 0040C45B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Path$AppendDeleteFileFolder
                                                                          • String ID: bowsakkdestx.txt
                                                                          • API String ID: 610490371-2616962270
                                                                          • Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
                                                                          • Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
                                                                          • Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
                                                                          • Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID: p2Q
                                                                          • API String ID: 2102423945-1521255505
                                                                          • Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                          • Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
                                                                          • Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                          • Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memmove_strtok
                                                                          • String ID:
                                                                          • API String ID: 3446180046-0
                                                                          • Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
                                                                          • Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
                                                                          • Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
                                                                          • Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset$__filbuf__getptd_noexit__read_nolock
                                                                          • String ID:
                                                                          • API String ID: 2974526305-0
                                                                          • Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
                                                                          • Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
                                                                          • Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
                                                                          • Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
                                                                          • __isleadbyte_l.LIBCMT ref: 0043C6DB
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                          • String ID:
                                                                          • API String ID: 3058430110-0
                                                                          • Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
                                                                          • Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
                                                                          • Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
                                                                          • Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
                                                                          • lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
                                                                          • WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
                                                                          • CloseHandle.KERNEL32(00000000), ref: 0040F1A8
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: File$CloseCreateHandleWritelstrlen
                                                                          • String ID:
                                                                          • API String ID: 1421093161-0
                                                                          • Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
                                                                          • Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
                                                                          • Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
                                                                          • Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___BuildCatchObject.LIBCMT ref: 004C70AB
                                                                            • Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
                                                                            • Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9
                                                                          • _UnwindNestedFrames.LIBCMT ref: 004C70C2
                                                                          • ___FrameUnwindToState.LIBCMT ref: 004C70D4
                                                                          • CallCatchBlock.LIBCMT ref: 004C70F8
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
                                                                          • String ID:
                                                                          • API String ID: 2901542994-0
                                                                          • Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                          • Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
                                                                          • Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                          • Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
                                                                            • Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015
                                                                          • __calloc_crt.LIBCMT ref: 00425A01
                                                                            • Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5
                                                                          • __lock.LIBCMT ref: 00425A37
                                                                          • ___addlocaleref.LIBCMT ref: 00425A43
                                                                          • __lock.LIBCMT ref: 00425A57
                                                                            • Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
                                                                          • String ID:
                                                                          • API String ID: 2580527540-0
                                                                          • Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
                                                                          • Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
                                                                          • Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
                                                                          • Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                          • String ID:
                                                                          • API String ID: 3016257755-0
                                                                          • Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                          • Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
                                                                          • Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                          • Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • lstrlenW.KERNEL32 ref: 004127B9
                                                                          • _malloc.LIBCMT ref: 004127C3
                                                                            • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                            • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                            • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                          • _memset.LIBCMT ref: 004127CE
                                                                          • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
                                                                          • String ID:
                                                                          • API String ID: 2824100046-0
                                                                          • Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
                                                                          • Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
                                                                          • Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
                                                                          • Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • lstrlenA.KERNEL32 ref: 00412806
                                                                          • _malloc.LIBCMT ref: 00412814
                                                                            • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                            • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                            • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                          • _memset.LIBCMT ref: 0041281F
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
                                                                          • String ID:
                                                                          • API String ID: 2824100046-0
                                                                          • Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
                                                                          • Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
                                                                          • Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
                                                                          • Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memmove
                                                                          • String ID: invalid string position$string too long
                                                                          • API String ID: 4104443479-4289949731
                                                                          • Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
                                                                          • Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
                                                                          • Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
                                                                          • Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memmove
                                                                          • String ID: invalid string position$string too long
                                                                          • API String ID: 4104443479-4289949731
                                                                          • Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
                                                                          • Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
                                                                          • Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
                                                                          • Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA
                                                                            • Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
                                                                            • Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
                                                                            • Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
                                                                            • Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277
                                                                            • Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
                                                                            • Part of subcall function 0041BA10: RegisterClassExW.USER32 ref: 0041BA73
                                                                            • Part of subcall function 0041BA80: CreateWindowExW.USER32 ref: 0041BAAD
                                                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
                                                                          • TranslateMessage.USER32(?), ref: 0041B4CD
                                                                          • DispatchMessageW.USER32 ref: 0041B4D7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
                                                                          • String ID: %username%$I:\5d2860c89d774.jpg
                                                                          • API String ID: 441990211-897913220
                                                                          • Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
                                                                          • Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
                                                                          • Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
                                                                          • Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: .\crypto\err\err.c$unknown
                                                                          • API String ID: 0-565200744
                                                                          • Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
                                                                          • Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
                                                                          • Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
                                                                          • Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
                                                                          • ___raise_securityfailure.LIBCMT ref: 0042AC7A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                          • String ID: 8Q
                                                                          • API String ID: 3761405300-2096853525
                                                                          • Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
                                                                          • Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
                                                                          • Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
                                                                          • Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0
                                                                            • Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64
                                                                          • _memset.LIBCMT ref: 00413C83
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
                                                                          • String ID: vector<T> too long
                                                                          • API String ID: 1327501947-3788999226
                                                                          • Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
                                                                          • Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
                                                                          • Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
                                                                          • Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _fputws$CreateDirectory
                                                                          • String ID: C:\SystemID$C:\SystemID\PersonalID.txt
                                                                          • API String ID: 2590308727-54166481
                                                                          • Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
                                                                          • Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
                                                                          • Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
                                                                          • Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          • Assertion failed: %s, file %s, line %d, xrefs: 00420E13
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: __calloc_crt
                                                                          • String ID: Assertion failed: %s, file %s, line %d
                                                                          • API String ID: 3494438863-969893948
                                                                          • Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
                                                                          • Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
                                                                          • Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
                                                                          • Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00480686
                                                                            • Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18
                                                                          Strings
                                                                          • ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
                                                                          • .\crypto\evp\digest.c, xrefs: 00480638
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: _memset_raise
                                                                          • String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
                                                                          • API String ID: 1484197835-3867593797
                                                                          • Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
                                                                          • Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
                                                                          • Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
                                                                          • Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • std::exception::exception.LIBCMT ref: 0044F251
                                                                            • Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15
                                                                          • __CxxThrowException@8.LIBCMT ref: 0044F266
                                                                            • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 0000000B.00000002.435887482.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                          • Associated: 0000000B.00000002.435887482.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          • Associated: 0000000B.00000002.435887482.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_11_2_400000_4A15.jbxd
                                                                          Yara matches
                                                                          Similarity
                                                                          • API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
                                                                          • String ID: TeM
                                                                          • API String ID: 757275642-2215902641
                                                                          • Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                          • Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
                                                                          • Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                          • Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%